openship 0.2.1 → 0.2.3

package/dist/index.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { Command as Command25 } from "commander";
+import { Command as Command27 } from "commander";
 
 // src/lib/output.ts
 import chalk from "chalk";
@@ -905,10 +905,17 @@ var PLANS = {
     description: "Get started for free",
     price: { monthly: 0, annual: 0 },
     stripePriceId: { monthly: null, annual: null },
-    // Paid tiers below are `null` (price + credits) until Openship Cloud pricing
-    // is finalized — the UI renders "coming soon". Self-hosted is free and never
-    // surfaces any of these numbers.
-    monthlyCredits: null,
+    // Public dollar `price` on the paid tiers is `null` — the UI renders
+    // "coming soon" and the Subscribe CTA stays disabled. Cloud pricing is
+    // intentionally NOT published yet. `monthlyCredits` (the CPU-time/credit
+    // quota pushed to Oblien) is real so tiers still enforce — it's an internal
+    // number, never shown as a price. NOTE (tune before launch): these credit
+    // numbers are placeholders sized to Oblien's 10,000,000-credit ceiling; the
+    // true credit-per-$/per-cpu-minute rate is Oblien-configured. 1 openship
+    // credit = 1 Oblien credit = 1000 milli (the wrapper divides by 1000 at the
+    // Oblien boundary). Self-hosted is free and surfaces none of these numbers.
+    monthlyCredits: 5e5,
+    // 500 credits — free-tier allowance
     oblienLimits: {
       max_workspaces: 1,
       max_vcpus: 2,
@@ -927,12 +934,13 @@ var PLANS = {
     name: "Pro",
     description: "For solo builders shipping production workloads",
     price: { monthly: null, annual: null },
-    // coming soon
+    // coming soon — pricing not published
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_PRO_MONTHLY ?? "price_pro_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_PRO_ANNUAL ?? "price_pro_annual_placeholder"
     },
-    monthlyCredits: null,
+    monthlyCredits: 1e7,
+    // 10,000 credits/mo (placeholder — tune before launch)
     oblienLimits: {
       max_workspaces: 10,
       max_vcpus: 16,
@@ -951,12 +959,13 @@ var PLANS = {
     name: "Team",
     description: "For teams collaborating on shared infra",
     price: { monthly: null, annual: null },
-    // coming soon
+    // coming soon — pricing not published
     stripePriceId: {
       monthly: process.env.STRIPE_PRICE_TEAM_MONTHLY ?? "price_team_monthly_placeholder",
       annual: process.env.STRIPE_PRICE_TEAM_ANNUAL ?? "price_team_annual_placeholder"
     },
-    monthlyCredits: null,
+    monthlyCredits: 6e7,
+    // 60,000 credits/mo (placeholder — tune before launch)
     oblienLimits: {
       max_workspaces: 50,
       max_vcpus: 64,
@@ -1798,6 +1807,425 @@ var LANGUAGE_MANIFEST_FILES = Array.from(
   new Set(LANGUAGE_DETECTORS.flatMap((d) => d.manifestFiles.map((f) => f.toLowerCase())))
 );
 
+// ../../packages/core/src/openship-config/schema.ts
+var OPENSHIP_RUNTIMES = ["bare", "docker"];
+var OPENSHIP_PRODUCTION_MODES = [
+  "host",
+  "static",
+  "standalone"
+];
+var OPENSHIP_DOMAIN_TYPES = ["free", "custom"];
+var OPENSHIP_RESTARTS = [
+  "no",
+  "always",
+  "on-failure",
+  "unless-stopped"
+];
+var OPENSHIP_RESOURCE_TIERS = [
+  "micro",
+  "low",
+  "medium",
+  "high"
+];
+
+// ../../packages/core/src/openship-config/parse.ts
+var TOP_LEVEL_KEYS = /* @__PURE__ */ new Set([
+  "$schema",
+  "framework",
+  "packageManager",
+  "rootDirectory",
+  "installCommand",
+  "buildCommand",
+  "startCommand",
+  "outputDirectory",
+  "buildImage",
+  "productionPaths",
+  "runtime",
+  "productionMode",
+  "port",
+  "env",
+  "domains",
+  "routes",
+  "resources",
+  "services",
+  "monorepo"
+]);
+var Ctx = class {
+  errors = [];
+  warnings = [];
+  err(path2, msg) {
+    this.errors.push(`${path2}: ${msg}`);
+  }
+  isObj(v) {
+    return typeof v === "object" && v !== null && !Array.isArray(v);
+  }
+  str(v, path2) {
+    if (v === void 0) return void 0;
+    if (typeof v !== "string") {
+      this.err(path2, "must be a string");
+      return void 0;
+    }
+    return v;
+  }
+  bool(v, path2) {
+    if (v === void 0) return void 0;
+    if (typeof v !== "boolean") {
+      this.err(path2, "must be a boolean");
+      return void 0;
+    }
+    return v;
+  }
+  int(v, path2, min, max) {
+    if (v === void 0) return void 0;
+    const n = typeof v === "string" ? Number(v) : v;
+    if (typeof n !== "number" || !Number.isFinite(n)) {
+      this.err(path2, "must be a number");
+      return void 0;
+    }
+    if (n < min || n > max) {
+      this.err(path2, `must be between ${min} and ${max}`);
+      return void 0;
+    }
+    return n;
+  }
+  strArray(v, path2) {
+    if (v === void 0) return void 0;
+    if (!Array.isArray(v)) {
+      this.err(path2, "must be an array of strings");
+      return void 0;
+    }
+    const out = [];
+    v.forEach((item, i) => {
+      if (typeof item !== "string") this.err(`${path2}[${i}]`, "must be a string");
+      else out.push(item);
+    });
+    return out;
+  }
+  enumOf(v, path2, allowed) {
+    if (v === void 0) return void 0;
+    if (typeof v !== "string" || !allowed.includes(v)) {
+      this.err(path2, `must be one of: ${allowed.join(", ")}`);
+      return void 0;
+    }
+    return v;
+  }
+};
+function parseEnv(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object of environment variables");
+    return void 0;
+  }
+  const out = {};
+  for (const [key, val] of Object.entries(v)) {
+    if (typeof val === "string") {
+      out[key] = val;
+    } else if (ctx.isObj(val)) {
+      if (val.value === void 0) ctx.err(`${path2}.${key}.value`, "is required");
+      const value = ctx.str(val.value, `${path2}.${key}.value`);
+      const secret = ctx.bool(val.secret, `${path2}.${key}.secret`);
+      if (value !== void 0) out[key] = { value, ...secret !== void 0 ? { secret } : {} };
+    } else {
+      ctx.err(`${path2}.${key}`, 'must be a string or { "value", "secret" }');
+    }
+  }
+  return out;
+}
+function parseDomains(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!Array.isArray(v)) {
+    ctx.err(path2, "must be an array of hostnames or domain objects");
+    return void 0;
+  }
+  const out = [];
+  v.forEach((item, i) => {
+    const p = `${path2}[${i}]`;
+    if (typeof item === "string") {
+      out.push({ domain: item });
+    } else if (ctx.isObj(item)) {
+      const domain = ctx.str(item.domain, `${p}.domain`);
+      if (!domain) {
+        ctx.err(p, "requires a `domain`");
+        return;
+      }
+      out.push({
+        domain,
+        port: ctx.int(item.port, `${p}.port`, 1, 65535),
+        targetPath: ctx.str(item.targetPath, `${p}.targetPath`),
+        type: ctx.enumOf(item.type, `${p}.type`, OPENSHIP_DOMAIN_TYPES)
+      });
+    } else {
+      ctx.err(p, "must be a hostname string or a domain object");
+    }
+  });
+  return out;
+}
+function parseRoutes(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const routes = {};
+  const rule = (item, p) => {
+    if (!ctx.isObj(item)) {
+      ctx.err(p, "must be an object with `source` and `destination`");
+      return null;
+    }
+    const source = ctx.str(item.source, `${p}.source`);
+    const destination = ctx.str(item.destination, `${p}.destination`);
+    return source && destination ? { source, destination } : null;
+  };
+  if (Array.isArray(v.rewrites)) {
+    routes.rewrites = v.rewrites.map((r, i) => rule(r, `${path2}.rewrites[${i}]`)).filter(Boolean);
+  } else if (v.rewrites !== void 0) ctx.err(`${path2}.rewrites`, "must be an array");
+  if (Array.isArray(v.redirects)) {
+    routes.redirects = v.redirects.map((r, i) => {
+      const base = rule(r, `${path2}.redirects[${i}]`);
+      if (!base) return null;
+      const o = r;
+      return {
+        ...base,
+        permanent: ctx.bool(o.permanent, `${path2}.redirects[${i}].permanent`),
+        statusCode: ctx.int(o.statusCode, `${path2}.redirects[${i}].statusCode`, 300, 399)
+      };
+    }).filter(Boolean);
+  } else if (v.redirects !== void 0) ctx.err(`${path2}.redirects`, "must be an array");
+  if (Array.isArray(v.headers)) {
+    routes.headers = v.headers.map((h, i) => {
+      const p = `${path2}.headers[${i}]`;
+      if (!ctx.isObj(h)) {
+        ctx.err(p, "must be an object");
+        return null;
+      }
+      const source = ctx.str(h.source, `${p}.source`);
+      const list2 = Array.isArray(h.headers) ? h.headers.map((kv, j) => {
+        const key = ctx.str(kv?.key, `${p}.headers[${j}].key`);
+        const value = ctx.str(kv?.value, `${p}.headers[${j}].value`);
+        return key && value !== void 0 ? { key, value } : null;
+      }).filter(Boolean) : [];
+      return source ? { source, headers: list2 } : null;
+    }).filter(Boolean);
+  } else if (v.headers !== void 0) ctx.err(`${path2}.headers`, "must be an array");
+  const cleanUrls = ctx.bool(v.cleanUrls, `${path2}.cleanUrls`);
+  const trailingSlash = ctx.bool(v.trailingSlash, `${path2}.trailingSlash`);
+  if (cleanUrls !== void 0) routes.cleanUrls = cleanUrls;
+  if (trailingSlash !== void 0) routes.trailingSlash = trailingSlash;
+  return routes;
+}
+function parseResources(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const r = {
+    tier: ctx.enumOf(v.tier, `${path2}.tier`, OPENSHIP_RESOURCE_TIERS),
+    cpuCores: ctx.int(v.cpuCores, `${path2}.cpuCores`, 0.25, 4),
+    memoryMb: ctx.int(v.memoryMb, `${path2}.memoryMb`, 128, 8192),
+    diskMb: ctx.int(v.diskMb, `${path2}.diskMb`, 64, 204800)
+  };
+  return r;
+}
+function parseHealthcheck(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const test = typeof v.test === "string" ? v.test : Array.isArray(v.test) ? ctx.strArray(v.test, `${path2}.test`) : v.test !== void 0 ? (ctx.err(`${path2}.test`, "must be a string or array of strings"), void 0) : void 0;
+  return {
+    test,
+    interval: ctx.str(v.interval, `${path2}.interval`),
+    timeout: ctx.str(v.timeout, `${path2}.timeout`),
+    retries: ctx.int(v.retries, `${path2}.retries`, 0, 100),
+    startPeriod: ctx.str(v.startPeriod, `${path2}.startPeriod`),
+    disable: ctx.bool(v.disable, `${path2}.disable`)
+  };
+}
+function parseServices(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!Array.isArray(v)) {
+    ctx.err(path2, "must be an array of service objects");
+    return void 0;
+  }
+  const out = [];
+  v.forEach((item, i) => {
+    const p = `${path2}[${i}]`;
+    if (!ctx.isObj(item)) {
+      ctx.err(p, "must be an object");
+      return;
+    }
+    const name = ctx.str(item.name, `${p}.name`);
+    if (!name) {
+      ctx.err(p, "requires a `name`");
+      return;
+    }
+    out.push({
+      name,
+      image: ctx.str(item.image, `${p}.image`),
+      build: ctx.str(item.build, `${p}.build`),
+      dockerfile: ctx.str(item.dockerfile, `${p}.dockerfile`),
+      ports: ctx.strArray(item.ports, `${p}.ports`),
+      volumes: ctx.strArray(item.volumes, `${p}.volumes`),
+      dependsOn: ctx.strArray(item.dependsOn, `${p}.dependsOn`),
+      env: parseEnv(ctx, item.env, `${p}.env`),
+      command: ctx.str(item.command, `${p}.command`),
+      restart: ctx.enumOf(item.restart, `${p}.restart`, OPENSHIP_RESTARTS),
+      exposed: ctx.bool(item.exposed, `${p}.exposed`),
+      exposedPort: ctx.str(item.exposedPort, `${p}.exposedPort`),
+      domain: ctx.str(item.domain, `${p}.domain`),
+      healthcheck: parseHealthcheck(ctx, item.healthcheck, `${p}.healthcheck`)
+    });
+  });
+  return out;
+}
+function parseMonorepo(ctx, v, path2) {
+  if (v === void 0) return void 0;
+  if (!ctx.isObj(v)) {
+    ctx.err(path2, "must be an object");
+    return void 0;
+  }
+  const mono = {};
+  if (v.workspace !== void 0) {
+    if (!ctx.isObj(v.workspace)) ctx.err(`${path2}.workspace`, "must be an object");
+    else {
+      const pm = ctx.str(v.workspace.packageManager, `${path2}.workspace.packageManager`);
+      if (pm) {
+        mono.workspace = {
+          packageManager: pm,
+          prepareCommand: ctx.str(v.workspace.prepareCommand, `${path2}.workspace.prepareCommand`)
+        };
+      } else {
+        ctx.err(`${path2}.workspace`, "requires a `packageManager`");
+      }
+    }
+  }
+  if (v.sharedPaths !== void 0) {
+    ctx.warnings.push(`${path2}.sharedPaths is not applied yet (ignored)`);
+  }
+  if (v.apps !== void 0) {
+    if (!Array.isArray(v.apps)) ctx.err(`${path2}.apps`, "must be an array");
+    else {
+      const apps = [];
+      v.apps.forEach((a, i) => {
+        const p = `${path2}.apps[${i}]`;
+        if (!ctx.isObj(a)) {
+          ctx.err(p, "must be an object");
+          return;
+        }
+        const name = ctx.str(a.name, `${p}.name`);
+        const rootDirectory = ctx.str(a.rootDirectory, `${p}.rootDirectory`);
+        if (!name || !rootDirectory) {
+          ctx.err(p, "requires `name` and `rootDirectory`");
+          return;
+        }
+        apps.push({
+          name,
+          rootDirectory,
+          framework: ctx.enumOf(a.framework, `${p}.framework`, STACK_IDS),
+          packageManager: parsePackageManager(ctx, a.packageManager, `${p}.packageManager`),
+          installCommand: ctx.str(a.installCommand, `${p}.installCommand`),
+          buildCommand: ctx.str(a.buildCommand, `${p}.buildCommand`),
+          startCommand: ctx.str(a.startCommand, `${p}.startCommand`),
+          outputDirectory: ctx.str(a.outputDirectory, `${p}.outputDirectory`),
+          buildImage: ctx.str(a.buildImage, `${p}.buildImage`),
+          port: ctx.int(a.port, `${p}.port`, 1, 65535)
+        });
+      });
+      mono.apps = apps;
+    }
+  }
+  return mono;
+}
+function parsePackageManager(ctx, v, path2) {
+  const s = ctx.str(v, path2);
+  if (s === void 0) return void 0;
+  if (!ALL_PACKAGE_MANAGERS.includes(s)) {
+    ctx.err(path2, `must be one of: ${ALL_PACKAGE_MANAGERS.join(", ")}`);
+    return void 0;
+  }
+  return s;
+}
+function parseOpenshipConfig(raw) {
+  const ctx = new Ctx();
+  if (!ctx.isObj(raw)) {
+    return { config: null, errors: ["openship.json must be a JSON object"], warnings: [] };
+  }
+  for (const key of Object.keys(raw)) {
+    if (!TOP_LEVEL_KEYS.has(key)) ctx.warnings.push(`Unknown field "${key}" (ignored)`);
+  }
+  const config = {
+    framework: ctx.enumOf(raw.framework, "framework", STACK_IDS),
+    packageManager: parsePackageManager(ctx, raw.packageManager, "packageManager"),
+    rootDirectory: ctx.str(raw.rootDirectory, "rootDirectory"),
+    installCommand: ctx.str(raw.installCommand, "installCommand"),
+    buildCommand: ctx.str(raw.buildCommand, "buildCommand"),
+    startCommand: ctx.str(raw.startCommand, "startCommand"),
+    outputDirectory: ctx.str(raw.outputDirectory, "outputDirectory"),
+    buildImage: ctx.str(raw.buildImage, "buildImage"),
+    productionPaths: ctx.strArray(raw.productionPaths, "productionPaths"),
+    runtime: ctx.enumOf(raw.runtime, "runtime", OPENSHIP_RUNTIMES),
+    productionMode: ctx.enumOf(raw.productionMode, "productionMode", OPENSHIP_PRODUCTION_MODES),
+    port: ctx.int(raw.port, "port", 1, 65535),
+    env: parseEnv(ctx, raw.env, "env"),
+    domains: parseDomains(ctx, raw.domains, "domains"),
+    routes: parseRoutes(ctx, raw.routes, "routes"),
+    resources: parseResources(ctx, raw.resources, "resources"),
+    services: parseServices(ctx, raw.services, "services"),
+    monorepo: parseMonorepo(ctx, raw.monorepo, "monorepo")
+  };
+  for (const k of Object.keys(config)) {
+    if (config[k] === void 0) delete config[k];
+  }
+  return { config, errors: ctx.errors, warnings: ctx.warnings };
+}
+function parseOpenshipConfigJson(text2) {
+  let raw;
+  try {
+    raw = JSON.parse(text2);
+  } catch (err2) {
+    return {
+      config: null,
+      errors: [`invalid JSON: ${err2 instanceof Error ? err2.message : String(err2)}`],
+      warnings: []
+    };
+  }
+  return parseOpenshipConfig(raw);
+}
+
+// ../../packages/core/src/metadata/openship.ts
+var openshipMetadataParser = {
+  source: "openship",
+  files: ["openship.json"],
+  parse(fileContents) {
+    const raw = fileContents["openship.json"];
+    if (!raw) return null;
+    const { config } = parseOpenshipConfigJson(raw);
+    if (!config) return null;
+    const metadata = { source: "openship" };
+    if (config.installCommand) metadata.installCommand = config.installCommand;
+    if (config.buildCommand) metadata.buildCommand = config.buildCommand;
+    if (config.outputDirectory) metadata.outputDirectory = config.outputDirectory;
+    if (config.startCommand) metadata.startCommand = config.startCommand;
+    if (config.framework) metadata.framework = config.framework;
+    if (config.routes) metadata.routing = config.routes;
+    const hasSignal = config.installCommand || config.buildCommand || config.outputDirectory || config.startCommand || config.framework || config.routes;
+    return hasSignal ? metadata : null;
+  }
+};
+
+// ../../packages/core/src/metadata/text.ts
+function stripBom2(content) {
+  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+}
+function trimmed(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
+}
+function splitLines(raw) {
+  return stripBom2(raw).split(/\r?\n/);
+}
+
 // ../../packages/core/src/metadata/vercel.ts
 var VERCEL_FRAMEWORK_TO_STACK = {
   nextjs: "nextjs",
@@ -1812,9 +2240,6 @@ var VERCEL_FRAMEWORK_TO_STACK = {
   angular: "angular",
   "create-react-app": "cra"
 };
-function trimmed(value) {
-  return typeof value === "string" && value.trim().length > 0 ? value.trim() : void 0;
-}
 function isConditional(entry) {
   return "has" in entry || "missing" in entry;
 }
@@ -1933,10 +2358,152 @@ var vercelMetadataParser = {
   }
 };
 
-// ../../packages/core/src/metadata/render.ts
-function stripBom2(content) {
-  return content.charCodeAt(0) === 65279 ? content.slice(1) : content;
+// ../../packages/core/src/metadata/railway.ts
+function tomlScalar(rest) {
+  const s = rest.trim();
+  const quote = s[0];
+  if (quote === '"' || quote === "'") {
+    let out = "";
+    for (let i = 1; i < s.length; i++) {
+      const ch = s[i];
+      if (quote === '"' && ch === "\\" && i + 1 < s.length) {
+        const next = s[++i];
+        switch (next) {
+          case "t":
+            out += "	";
+            break;
+          case "n":
+            out += "\n";
+            break;
+          case "r":
+            out += "\r";
+            break;
+          case "b":
+            out += "\b";
+            break;
+          case "f":
+            out += "\f";
+            break;
+          case '"':
+            out += '"';
+            break;
+          case "\\":
+            out += "\\";
+            break;
+          case "/":
+            out += "/";
+            break;
+          case "u":
+          case "U": {
+            const width = next === "u" ? 4 : 8;
+            const hex = s.slice(i + 1, i + 1 + width);
+            if (hex.length === width && /^[0-9a-fA-F]+$/.test(hex)) {
+              out += String.fromCodePoint(parseInt(hex, 16));
+              i += width;
+            } else {
+              out += next;
+            }
+            break;
+          }
+          default:
+            out += next;
+        }
+        continue;
+      }
+      if (ch === quote) return out;
+      out += ch;
+    }
+    return void 0;
+  }
+  const bare = s.split("#")[0].trim();
+  return bare.length > 0 ? bare : void 0;
+}
+function parseRailwayToml(raw) {
+  const cfg = {};
+  let section = "";
+  const lines = splitLines(raw);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    const header = line.match(/^\s*\[([^\]]+)\]\s*(?:#.*)?$/);
+    if (header) {
+      section = header[1].trim().toLowerCase();
+      continue;
+    }
+    const kv = line.match(/^\s*([A-Za-z_][A-Za-z0-9_.-]*)\s*=\s*(.+)$/);
+    if (!kv) continue;
+    const [, rawKey, rest] = kv;
+    const dot = rawKey.lastIndexOf(".");
+    const table = dot >= 0 ? rawKey.slice(0, dot).toLowerCase() : section;
+    const field = dot >= 0 ? rawKey.slice(dot + 1) : rawKey;
+    let value;
+    const triple = rest.match(/^("""|''')/);
+    if (triple) {
+      const delim = triple[1];
+      const afterOpen = rest.slice(3);
+      const close = afterOpen.indexOf(delim);
+      if (close >= 0) {
+        value = afterOpen.slice(0, close).trim() || void 0;
+      } else {
+        while (++i < lines.length && !lines[i].includes(delim)) {
+        }
+        value = void 0;
+      }
+    } else {
+      value = tomlScalar(rest);
+    }
+    if (!value) continue;
+    if (table === "build") {
+      if (field === "buildCommand") cfg.buildCommand ??= value;
+      else if (field === "builder") cfg.builder ??= value;
+    } else if (table === "deploy") {
+      if (field === "startCommand") cfg.startCommand ??= value;
+    }
+  }
+  return cfg;
+}
+function parseRailwayJson(raw) {
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const obj = parsed;
+  const build = obj.build ?? {};
+  const deploy = obj.deploy ?? {};
+  return {
+    builder: trimmed(build.builder),
+    buildCommand: trimmed(build.buildCommand),
+    startCommand: trimmed(deploy.startCommand)
+  };
 }
+function toMetadata(cfg) {
+  const buildCommand = trimmed(cfg.buildCommand);
+  const startCommand = trimmed(cfg.startCommand);
+  const framework = cfg.builder?.toUpperCase() === "DOCKERFILE" ? "docker" : void 0;
+  if (!buildCommand && !startCommand && !framework) return null;
+  const metadata = { source: "railway" };
+  if (buildCommand) metadata.buildCommand = buildCommand;
+  if (startCommand) metadata.startCommand = startCommand;
+  if (framework) metadata.framework = framework;
+  if (extractCdTargets(buildCommand).length > 0) metadata.nonLocal = true;
+  return metadata;
+}
+var railwayMetadataParser = {
+  source: "railway",
+  files: ["railway.toml", "railway.json"],
+  parse(fileContents) {
+    const tomlRaw = fileContents["railway.toml"];
+    const jsonRaw = fileContents["railway.json"];
+    const fromToml = tomlRaw ? toMetadata(parseRailwayToml(tomlRaw)) : null;
+    if (fromToml) return fromToml;
+    const jsonCfg = jsonRaw ? parseRailwayJson(jsonRaw) : null;
+    return jsonCfg ? toMetadata(jsonCfg) : null;
+  }
+};
+
+// ../../packages/core/src/metadata/render.ts
 function unquote(value) {
   const trimmed2 = value.trim();
   const m = trimmed2.match(/^(['"])(.*)\1$/);
@@ -1948,7 +2515,7 @@ var renderMetadataParser = {
   parse(fileContents) {
     const raw = fileContents["render.yaml"];
     if (!raw) return null;
-    const lines = stripBom2(raw).split("\n");
+    const lines = splitLines(raw);
     let startCommand;
     let buildCommand;
     const env = {};
@@ -1982,7 +2549,9 @@ var renderMetadataParser = {
 
 // ../../packages/core/src/metadata/index.ts
 var METADATA_PARSERS = [
+  openshipMetadataParser,
   vercelMetadataParser,
+  railwayMetadataParser,
   renderMetadataParser
 ];
 var METADATA_FILES = new Set(
@@ -2369,11 +2938,11 @@ var openCommand = new Command3("open").description("Open the Openship dashboard
 import { Command as Command4 } from "commander";
 import chalk5 from "chalk";
 import ora from "ora";
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { randomBytes } from "crypto";
-import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync2, writeFileSync as writeFileSync4 } from "fs";
-import { homedir as homedir4 } from "os";
-import { dirname as dirname2, join as join5 } from "path";
+import { createWriteStream as createWriteStream2, existsSync as existsSync6, mkdirSync as mkdirSync7, readFileSync as readFileSync4, writeFileSync as writeFileSync5 } from "fs";
+import { homedir as homedir6 } from "os";
+import { dirname as dirname2, join as join7 } from "path";
 import { fileURLToPath } from "url";
 
 // src/lib/dashboard.ts
@@ -2423,8 +2992,8 @@ async function downloadToFile(url, dest, onProgress) {
   } finally {
     file.end();
   }
-  await new Promise((resolve2, reject2) => {
-    file.on("finish", () => resolve2());
+  await new Promise((resolve3, reject2) => {
+    file.on("finish", () => resolve3());
     file.on("error", reject2);
   });
   return { sha256: hash.digest("hex"), size: received };
@@ -2480,16 +3049,29 @@ function assetName(tag) {
 async function ensureDashboard(opts = {}) {
   const override = process.env.OPENSHIP_DASHBOARD_DIR?.trim();
   if (override) {
-    const cwd2 = join3(override, "apps", "dashboard");
-    const entry2 = join3(cwd2, "server.js");
-    if (!existsSync2(entry2)) {
+    const cwd = join3(override, "apps", "dashboard");
+    const entry = join3(cwd, "server.js");
+    if (!existsSync2(entry)) {
       throw new Error(
-        `OPENSHIP_DASHBOARD_DIR=${override} but ${entry2} is missing \u2014 build the dashboard standalone first (see docs).`
+        `OPENSHIP_DASHBOARD_DIR=${override} but ${entry} is missing \u2014 build the dashboard standalone first (see docs).`
       );
     }
-    return { tag: "local", entry: entry2, cwd: cwd2 };
+    return { tag: "local", entry, cwd };
   }
-  const tag = opts.tag ?? await resolveLatestTag();
+  const requested = opts.tag ?? await resolveLatestTag();
+  try {
+    return await fetchBundle(requested, opts.onProgress);
+  } catch (err2) {
+    if (opts.tag && /\b404\b/.test(err2?.message ?? "")) {
+      const latest = await resolveLatestTag();
+      if (latest && latest !== requested) {
+        return await fetchBundle(latest, opts.onProgress);
+      }
+    }
+    throw err2;
+  }
+}
+async function fetchBundle(tag, onProgress) {
   const dir = join3(DASHBOARD_CACHE, tag);
   const cwd = join3(dir, "apps", "dashboard");
   const entry = join3(cwd, "server.js");
@@ -2501,7 +3083,7 @@ async function ensureDashboard(opts = {}) {
   mkdirSync3(dir, { recursive: true });
   const name = assetName(tag);
   const tarball = join3(dir, name);
-  const { sha256 } = await downloadToFile(assetUrl(tag, name), tarball, opts.onProgress);
+  const { sha256 } = await downloadToFile(assetUrl(tag, name), tarball, onProgress);
   const expected = await expectedSha256(tag, name);
   if (!expected) {
     throw new Error(
@@ -2527,7 +3109,7 @@ async function ensureDashboard(opts = {}) {
 
 // src/lib/service.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2 } from "fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, writeFileSync as writeFileSync3, rmSync as rmSync2, readFileSync as readFileSync2 } from "fs";
 import { homedir as homedir3 } from "os";
 import { join as join4, resolve } from "path";
 var HOME = homedir3();
@@ -2563,6 +3145,19 @@ function run(cmd, args) {
   const r = spawnSync2(cmd, args, { encoding: "utf8" });
   return { ok: r.status === 0, out: `${r.stdout ?? ""}${r.stderr ?? ""}`.trim() };
 }
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function launchdPid() {
+  const r = run("launchctl", ["list", MAC_LABEL]);
+  if (!r.ok) return null;
+  const m = r.out.match(/"PID"\s*=\s*(\d+)/);
+  return m ? Number(m[1]) : null;
+}
+function launchdLastExit() {
+  const m = run("launchctl", ["list", MAC_LABEL]).out.match(/"LastExitStatus"\s*=\s*(-?\d+)/);
+  return m ? Number(m[1]) : null;
+}
 function isRoot() {
   return typeof process.getuid === "function" && process.getuid() === 0;
 }
@@ -2683,7 +3278,16 @@ function restart() {
     if (!existsSync3(MAC_PLIST)) return { restarted: false, detail: "no launchd agent installed" };
     const uid = String(process.getuid?.() ?? "");
     const r = run("launchctl", ["kickstart", "-k", `gui/${uid}/${MAC_LABEL}`]);
-    return { restarted: r.ok, detail: r.ok ? `restarted ${MAC_LABEL}` : r.out };
+    if (!r.ok) return { restarted: false, detail: r.out || "launchctl kickstart failed" };
+    for (let i = 0; i < 6; i++) {
+      sleepSync(500);
+      if (launchdPid() != null) return { restarted: true, detail: `restarted ${MAC_LABEL}` };
+    }
+    const exit = launchdLastExit();
+    return {
+      restarted: false,
+      detail: `${MAC_LABEL} was killed but didn't stay up${exit != null ? ` (last exit ${exit})` : ""} \u2014 check logs in ${LOG_DIR}`
+    };
   }
   if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
@@ -2699,27 +3303,258 @@ function restart() {
   }
   return { restarted: false, detail: "no supported service manager" };
 }
+function serviceStatus() {
+  const kind = detectKind();
+  if (kind === "launchd") {
+    return { kind, installed: existsSync3(MAC_PLIST), running: launchdPid() != null };
+  }
+  if (kind === "systemd-user" || kind === "systemd-system") {
+    const sysArgs = kind === "systemd-user" ? ["--user"] : [];
+    const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
+    return {
+      kind,
+      installed: existsSync3(unitPath),
+      running: run("systemctl", [...sysArgs, "is-active", SYSTEMD_NAME]).out.trim() === "active"
+    };
+  }
+  if (kind === "schtasks") {
+    const q = run("schtasks", ["/Query", "/TN", WIN_TASK]);
+    return { kind, installed: q.ok, running: q.ok && /Running/i.test(q.out) };
+  }
+  return { kind, installed: false, running: false };
+}
+function sweepOrphanPorts() {
+  if (process.platform === "win32") return;
+  let ports = [];
+  try {
+    const raw = readFileSync2(join4(HOME, ".openship", "ports.json"), "utf8");
+    const p = JSON.parse(raw);
+    ports = [p.api, p.dashboard].filter((n) => typeof n === "number");
+  } catch {
+    return;
+  }
+  const self = process.pid;
+  for (const port of ports) {
+    const q = run("lsof", ["-ti", `tcp:${port}`]);
+    if (!q.ok) continue;
+    for (const token of q.out.split(/\s+/).filter(Boolean)) {
+      const pid = Number(token);
+      if (Number.isInteger(pid) && pid > 1 && pid !== self) {
+        try {
+          process.kill(pid, "SIGKILL");
+        } catch {
+        }
+      }
+    }
+  }
+}
 function stop() {
   const kind = detectKind();
+  let result;
   if (kind === "launchd") {
     run("launchctl", ["bootout", `gui/${process.getuid?.() ?? ""}/${MAC_LABEL}`]);
     if (existsSync3(MAC_PLIST)) rmSync2(MAC_PLIST, { force: true });
-    return { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
-  }
-  if (kind === "systemd-user" || kind === "systemd-system") {
+    result = { kind, detail: `launchd agent ${MAC_LABEL} stopped + removed` };
+  } else if (kind === "systemd-user" || kind === "systemd-system") {
     const sysArgs = kind === "systemd-user" ? ["--user"] : [];
     run("systemctl", [...sysArgs, "disable", "--now", SYSTEMD_NAME]);
     const unitPath = kind === "systemd-user" ? join4(HOME, ".config/systemd/user", `${SYSTEMD_NAME}.service`) : `/etc/systemd/system/${SYSTEMD_NAME}.service`;
     if (existsSync3(unitPath)) rmSync2(unitPath, { force: true });
     run("systemctl", [...sysArgs, "daemon-reload"]);
-    return { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
-  }
-  if (kind === "schtasks") {
+    result = { kind, detail: `systemd unit ${SYSTEMD_NAME} stopped + disabled` };
+  } else if (kind === "schtasks") {
     run("schtasks", ["/End", "/TN", WIN_TASK]);
     run("schtasks", ["/Delete", "/TN", WIN_TASK, "/F"]);
-    return { kind, detail: `Scheduled Task ${WIN_TASK} stopped + removed` };
+    result = { kind, detail: `Scheduled Task ${WIN_TASK} stopped + removed` };
+  } else {
+    result = { kind, detail: "no supported service manager \u2014 nothing to stop" };
+  }
+  sweepOrphanPorts();
+  return result;
+}
+
+// src/lib/ports.ts
+import { createServer } from "net";
+import { existsSync as existsSync4, mkdirSync as mkdirSync5, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+var OS_DIR2 = join5(homedir4(), ".openship");
+var PORTS_FILE = join5(OS_DIR2, "ports.json");
+var INSTANCE_FILE = join5(OS_DIR2, "instance.json");
+function saveInstanceUrl(publicUrl) {
+  try {
+    if (!existsSync4(OS_DIR2)) mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+    writeFileSync4(INSTANCE_FILE, JSON.stringify({ publicUrl: publicUrl ?? null }));
+  } catch {
+  }
+}
+function readInstanceUrl() {
+  try {
+    return JSON.parse(readFileSync3(INSTANCE_FILE, "utf8")).publicUrl ?? null;
+  } catch {
+    return null;
+  }
+}
+var DEFAULT_API = 4e3;
+var DEFAULT_DASHBOARD = 3001;
+function isPortFree(port) {
+  return new Promise((resolve3) => {
+    const srv = createServer();
+    srv.once("error", () => resolve3(false));
+    srv.listen(port, "127.0.0.1", () => srv.close(() => resolve3(true)));
+  });
+}
+async function waitPortFree(port, opts = {}) {
+  const timeoutMs = opts.timeoutMs ?? 6e3;
+  const intervalMs = opts.intervalMs ?? 250;
+  const deadline = Date.now() + timeoutMs;
+  for (; ; ) {
+    if (await isPortFree(port)) return true;
+    if (Date.now() >= deadline) return false;
+    await new Promise((r) => setTimeout(r, intervalMs));
+  }
+}
+function getFreePort() {
+  return new Promise((resolve3, reject2) => {
+    const srv = createServer();
+    srv.once("error", reject2);
+    srv.listen(0, "127.0.0.1", () => {
+      const addr = srv.address();
+      const port = addr && typeof addr === "object" ? addr.port : 0;
+      srv.close(() => port ? resolve3(port) : reject2(new Error("no free port")));
+    });
+  });
+}
+function loadStoredPorts() {
+  try {
+    return JSON.parse(readFileSync3(PORTS_FILE, "utf-8"));
+  } catch {
+    return {};
+  }
+}
+function saveStoredPorts(api, dashboard) {
+  try {
+    if (!existsSync4(OS_DIR2)) mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+    writeFileSync4(PORTS_FILE, JSON.stringify({ api, dashboard }));
+  } catch {
+  }
+}
+async function resolvePorts(prefs) {
+  const stored = loadStoredPorts();
+  const apiPref = prefs.api ?? stored.api ?? DEFAULT_API;
+  const dashPref = prefs.dashboard ?? stored.dashboard ?? DEFAULT_DASHBOARD;
+  const apiRemembered = prefs.api === void 0 && stored.api === apiPref;
+  const dashRemembered = prefs.dashboard === void 0 && stored.dashboard === dashPref;
+  let api;
+  if (await isPortFree(apiPref)) api = apiPref;
+  else if (apiRemembered && await waitPortFree(apiPref)) api = apiPref;
+  else api = await getFreePort();
+  let dashboard;
+  if (dashPref !== api && await isPortFree(dashPref)) dashboard = dashPref;
+  else if (dashPref !== api && dashRemembered && await waitPortFree(dashPref)) dashboard = dashPref;
+  else dashboard = await getFreePort();
+  if (dashboard === api) dashboard = await getFreePort();
+  saveStoredPorts(api, dashboard);
+  return {
+    api,
+    dashboard,
+    switched: { api: api !== apiPref, dashboard: dashboard !== dashPref }
+  };
+}
+
+// src/lib/from-source.ts
+import { spawn, spawnSync as spawnSync3 } from "child_process";
+import { existsSync as existsSync5, mkdirSync as mkdirSync6 } from "fs";
+import { homedir as homedir5 } from "os";
+import { join as join6, resolve as resolve2 } from "path";
+var OS_DIR3 = join6(homedir5(), ".openship");
+var DEFAULT_REPO = "https://github.com/oblien/openship.git";
+function has(cmd) {
+  try {
+    return spawnSync3(cmd, ["--version"], { stdio: "ignore" }).status === 0;
+  } catch {
+    return false;
+  }
+}
+function run2(cmd, args, cwd, env) {
+  return new Promise((res, rej) => {
+    const child = spawn(cmd, args, {
+      cwd,
+      stdio: "inherit",
+      env: env ? { ...process.env, ...env } : process.env
+    });
+    child.on("error", rej);
+    child.on(
+      "exit",
+      (code) => code === 0 ? res() : rej(new Error(`\`${cmd} ${args.join(" ")}\` (cwd=${cwd}) exited ${code ?? "?"}`))
+    );
+  });
+}
+function shortSha(cwd) {
+  const r = spawnSync3("git", ["rev-parse", "--short", "HEAD"], { cwd, encoding: "utf8" });
+  return r.status === 0 ? (r.stdout ?? "").trim() || "unknown" : "unknown";
+}
+function isMonorepo(dir) {
+  return existsSync5(join6(dir, "package.json")) && existsSync5(join6(dir, "apps/api/package.json")) && existsSync5(join6(dir, "apps/dashboard/package.json"));
+}
+async function prepareFromSource(opts) {
+  if (!has("bun")) {
+    throw new Error(
+      "`bun` is required to build from source but wasn't found on PATH \u2014 install it: https://bun.sh"
+    );
+  }
+  let sourceDir;
+  let ref;
+  if (opts.source) {
+    sourceDir = resolve2(opts.source);
+    if (!isMonorepo(sourceDir)) {
+      throw new Error(
+        `--source ${sourceDir} doesn't look like an Openship checkout (missing package.json / apps/api / apps/dashboard).`
+      );
+    }
+    ref = "local";
+  } else {
+    if (!has("git")) {
+      throw new Error("`git` is required to clone the source but wasn't found on PATH.");
+    }
+    ref = (opts.ref || "main").trim();
+    const repoUrl = opts.repo || DEFAULT_REPO;
+    sourceDir = join6(OS_DIR3, "src");
+    mkdirSync6(OS_DIR3, { recursive: true });
+    if (!existsSync5(join6(sourceDir, ".git"))) {
+      console.log(`  Cloning ${repoUrl} \u2192 ${sourceDir}`);
+      await run2("git", ["clone", repoUrl, sourceDir], OS_DIR3);
+    }
+    console.log(`  Fetching + checking out ${ref}`);
+    await run2("git", ["fetch", "origin", ref, "--tags"], sourceDir);
+    await run2("git", ["checkout", ref], sourceDir);
+    await run2("git", ["pull", "--ff-only", "origin", ref], sourceDir).catch(() => {
+      console.log("  (pinned ref \u2014 not fast-forwarding)");
+    });
   }
-  return { kind, detail: "no supported service manager \u2014 nothing to stop" };
+  const sha = shortSha(sourceDir);
+  console.log(`  Source: ${sourceDir} @ ${ref} (${sha})`);
+  console.log("  Installing workspace dependencies (bun install)\u2026");
+  await run2("bun", ["install"], sourceDir);
+  const distDir = join6(OS_DIR3, "from-source-dist");
+  console.log("  Building release dist (compiles the dashboard \u2014 needs RAM/CPU)\u2026");
+  await run2(
+    "bun",
+    ["run", join6(sourceDir, "apps/api/scripts/build-release.ts")],
+    sourceDir,
+    { DIST_DIR: distDir, NODE_ENV: "production", CLOUD_MODE: "false", OPENSHIP_TARGET: "local" }
+  );
+  console.log("  Installing runtime dependencies in the dist\u2026");
+  await run2("bun", ["install", "--production", "--frozen-lockfile"], distDir);
+  const apiDir = join6(distDir, "api");
+  const dashboardDir = join6(distDir, "dashboard");
+  if (!existsSync5(join6(apiDir, "src/index.ts"))) {
+    throw new Error(`Build produced no API at ${apiDir}/src/index.ts \u2014 build-release layout drift?`);
+  }
+  if (!existsSync5(join6(dashboardDir, "apps/dashboard/server.js"))) {
+    throw new Error(`Build produced no dashboard at ${dashboardDir}/apps/dashboard/server.js.`);
+  }
+  return { apiDir, dashboardDir, ref, sha, sourceDir };
 }
 
 // src/commands/up.ts
@@ -2744,22 +3579,22 @@ function normalizePublicUrl(raw) {
   return url;
 }
 var DIST_DIR = dirname2(fileURLToPath(import.meta.url));
-var SERVER_DIR = join5(DIST_DIR, "server");
-var OS_DIR2 = join5(homedir4(), ".openship");
+var SERVER_DIR = join7(DIST_DIR, "server");
+var OS_DIR4 = join7(homedir6(), ".openship");
 function ensureAuthSecret() {
-  const path2 = join5(OS_DIR2, "auth-secret");
-  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
-  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+  const path2 = join7(OS_DIR4, "auth-secret");
+  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync7(OS_DIR4, { recursive: true, mode: 448 });
   const secret = randomBytes(32).toString("hex");
-  writeFileSync4(path2, secret, { mode: 384 });
+  writeFileSync5(path2, secret, { mode: 384 });
   return secret;
 }
 function ensureInternalToken() {
-  const path2 = join5(OS_DIR2, "internal-token");
-  if (existsSync4(path2)) return readFileSync2(path2, "utf8").trim();
-  mkdirSync5(OS_DIR2, { recursive: true, mode: 448 });
+  const path2 = join7(OS_DIR4, "internal-token");
+  if (existsSync6(path2)) return readFileSync4(path2, "utf8").trim();
+  mkdirSync7(OS_DIR4, { recursive: true, mode: 448 });
   const token = randomBytes(32).toString("hex");
-  writeFileSync4(path2, token, { mode: 384 });
+  writeFileSync5(path2, token, { mode: 384 });
   return token;
 }
 var upCommand = new Command4("up").description("Start Openship as a persistent service (boot + auto-restart); --foreground to run attached").option("--port <port>", "API port to listen on", "4000").option("--data-dir <dir>", "Directory for the embedded database").option("--dashboard-port <port>", "Dashboard port", "3001").option("--no-ui", "Run the API only \u2014 don't download/serve the dashboard").option("--ui-version <tag>", "Dashboard release tag to run (default: this CLI's version)").option("-f, --foreground", "Run attached in this terminal instead of as a background service").option("--dry-run", "Print the service definition that would be installed, then exit").option(
@@ -2771,18 +3606,69 @@ var upCommand = new Command4("up").description("Start Openship as a persistent s
 ).option(
   "--managed-edge",
   "Managed edge: install OpenResty + a free Let's Encrypt cert on this box and route --public-url's domain to the dashboard (no reverse proxy needed)"
-).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").action(async (opts) => {
+).option("--acme-email <email>", "Contact email for Let's Encrypt certificates (managed edge)").option("--from-source", "Preview: build + run Openship from source (a branch) instead of a published release \u2014 runs attached").option("--ref <branch>", "Git branch/tag/sha to build with --from-source (default: main)").option("--source <path>", "Build from an existing local Openship checkout instead of cloning").option("--repo <url>", "Git remote to clone for --from-source (default: oblien/openship)").action(async (opts) => {
+  if (opts.fromSource || opts.source) return runFromSource(opts);
   if (opts.foreground) return runForeground(opts);
-  startService(opts);
+  await startService(opts);
 });
-function startService(opts, runOpts = {}) {
+async function runFromSource(opts) {
+  console.log(chalk5.cyan("\n  Building Openship from source (preview mode)\u2026"));
+  console.log(
+    chalk5.dim("  Unverified dev build \u2014 for previewing a branch, not production self-hosting.\n")
+  );
+  let src;
+  try {
+    src = await prepareFromSource({ ref: opts.ref, source: opts.source, repo: opts.repo });
+  } catch (e) {
+    console.error(
+      chalk5.red(`
+  Build from source failed: ${e.message}
+`) + chalk5.dim("  Small boxes can OOM on the dashboard build \u2014 build on a bigger machine and pass --source, or use a published release.\n")
+    );
+    process.exit(1);
+  }
+  console.log(chalk5.green(`
+  Built ${src.ref} (${src.sha}). Starting\u2026
+`));
+  await runForeground(opts, src);
+}
+async function startService(opts, runOpts = {}) {
   const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
-  const port = String(opts.port || "4000");
-  const dashPort = String(opts.dashboardPort || "3001");
+  if (opts.dryRun) {
+    const p = preview({
+      port: opts.port,
+      dataDir: opts.dataDir,
+      dashboardPort: opts.dashboardPort,
+      ui: opts.ui,
+      uiVersion: opts.uiVersion,
+      publicUrl,
+      trustProxy: opts.trustProxy || opts.managedEdge,
+      managedEdge: opts.managedEdge,
+      acmeEmail: opts.acmeEmail
+    });
+    console.log(
+      chalk5.dim(`
+  service manager: ${p.kind}
+  path: ${p.path}
+
+`) + p.content + "\n"
+    );
+    return {
+      port: String(opts.port || "4000"),
+      dashPort: String(opts.dashboardPort || "3001"),
+      publicUrl
+    };
+  }
+  const resolved = await resolvePorts({
+    api: opts.port ? Number(opts.port) : void 0,
+    dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+  });
+  const port = String(resolved.api);
+  const dashPort = String(resolved.dashboard);
   const flags = {
-    port: opts.port,
+    port,
     dataDir: opts.dataDir,
-    dashboardPort: opts.dashboardPort,
+    dashboardPort: dashPort,
     ui: opts.ui,
     uiVersion: opts.uiVersion,
     publicUrl,
@@ -2791,20 +3677,15 @@ function startService(opts, runOpts = {}) {
     managedEdge: opts.managedEdge,
     acmeEmail: opts.acmeEmail
   };
-  if (opts.dryRun) {
-    const p = preview(flags);
-    console.log(
-      chalk5.dim(`
-  service manager: ${p.kind}
-  path: ${p.path}
-
-`) + p.content + "\n"
-    );
-    return { port, dashPort, publicUrl };
-  }
   try {
     const res = installAndStart(flags);
     if (!runOpts.quiet) {
+      if (resolved.switched.api || resolved.switched.dashboard) {
+        console.log(
+          chalk5.yellow(`
+  A preferred port was busy \u2014 using API ${port}, dashboard ${dashPort}.`)
+        );
+      }
       const dashboardLine = publicUrl ? chalk5.dim(`  Dashboard: ${publicUrl}  (login required)
 `) : chalk5.dim(`  Dashboard: http://localhost:${dashPort}  (login required)
 `);
@@ -2825,20 +3706,38 @@ function startService(opts, runOpts = {}) {
     process.exit(1);
   }
 }
-async function runForeground(opts) {
-  const serverEntry = join5(SERVER_DIR, "index.js");
-  if (!existsSync4(serverEntry)) {
-    console.error(
-      chalk5.red("\n  Bundled server not found in this install.") + chalk5.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
-    );
-    process.exit(1);
+async function runForeground(opts, source) {
+  let apiCmd = process.execPath;
+  let apiArgs;
+  let apiCwd;
+  if (source) {
+    apiCmd = "bun";
+    apiArgs = ["run", "src/index.ts"];
+    apiCwd = source.apiDir;
+  } else {
+    const serverEntry = join7(SERVER_DIR, "index.js");
+    if (!existsSync6(serverEntry)) {
+      console.error(
+        chalk5.red("\n  Bundled server not found in this install.") + chalk5.dim("\n  Reinstall with `openship update` (or `npm i -g openship`).\n")
+      );
+      process.exit(1);
+    }
+    apiArgs = [serverEntry];
   }
-  const port = String(opts.port || "4000");
-  const dashPort = String(opts.dashboardPort || "3001");
+  const resolved = await resolvePorts({
+    api: opts.port ? Number(opts.port) : void 0,
+    dashboard: opts.dashboardPort ? Number(opts.dashboardPort) : void 0
+  });
+  const port = String(resolved.api);
+  const dashPort = String(resolved.dashboard);
   const publicUrl = opts.publicUrl ? normalizePublicUrl(opts.publicUrl) : void 0;
   const managedEdge = Boolean(opts.managedEdge && publicUrl);
-  const dataDir = opts.dataDir || join5(OS_DIR2, "data");
-  mkdirSync5(dataDir, { recursive: true });
+  const dataDir = opts.dataDir || join7(OS_DIR4, "data");
+  mkdirSync7(dataDir, { recursive: true });
+  const logDir = join7(OS_DIR4, "logs");
+  mkdirSync7(logDir, { recursive: true });
+  const instanceLogPath = join7(logDir, "instance.log");
+  const instanceLog = createWriteStream2(instanceLogPath, { flags: "w" });
   const env = {
     ...process.env,
     PORT: port,
@@ -2848,13 +3747,17 @@ async function runForeground(opts) {
     OPENSHIP_TARGET: "local",
     OPENSHIP_JOB_RUNNER: "in-process",
     PGLITE_DATA_DIR: dataDir,
-    OPENSHIP_MIGRATIONS_DIR: join5(SERVER_DIR, "migrations"),
-    OPENSHIP_PGLITE_ASSETS_DIR: join5(SERVER_DIR, "pglite"),
     BETTER_AUTH_SECRET: ensureAuthSecret()
   };
+  if (!source) {
+    env.OPENSHIP_MIGRATIONS_DIR = join7(SERVER_DIR, "migrations");
+    env.OPENSHIP_PGLITE_ASSETS_DIR = join7(SERVER_DIR, "pglite");
+  }
   env.OPENSHIP_REQUIRE_AUTH = "true";
   env.INTERNAL_TOKEN = ensureInternalToken();
   env.OPENSHIP_API_HOST = "127.0.0.1";
+  env.OPENSHIP_DASHBOARD_PORT = dashPort;
+  env.OPENSHIP_INSTANCE_LOG = instanceLogPath;
   delete env.OPENSHIP_ALLOW_ZERO_AUTH;
   if (publicUrl) {
     env.OPENSHIP_PUBLIC_URL = publicUrl;
@@ -2868,7 +3771,14 @@ async function runForeground(opts) {
   delete env.DATABASE_URL;
   delete env.POSTGRES_URL;
   const spinner3 = ora(`Starting Openship on http://localhost:${port} \u2026`).start();
-  const child = spawn(process.execPath, [serverEntry], { env, stdio: ["ignore", "pipe", "pipe"] });
+  const child = spawn2(apiCmd, apiArgs, {
+    cwd: apiCwd,
+    env,
+    stdio: ["ignore", "pipe", "pipe"],
+    detached: process.platform !== "win32"
+  });
+  child.stdout.on("data", (d) => instanceLog.write(d));
+  child.stderr.on("data", (d) => instanceLog.write(d));
   let buffered = "";
   const buffer = (d) => {
     buffered += d.toString();
@@ -2903,26 +3813,34 @@ async function runForeground(opts) {
   }
   spinner3.succeed(`Openship API running at http://localhost:${port}`);
   const children = [child];
-  const stopAll = () => {
-    for (const c of children) {
-      try {
-        c.kill("SIGTERM");
-      } catch {
-      }
-      setTimeout(() => {
-        try {
-          c.kill("SIGKILL");
-        } catch {
-        }
-      }, 5e3).unref?.();
+  const killTree = (c, sig) => {
+    try {
+      if (c.pid && process.platform !== "win32") process.kill(-c.pid, sig);
+      else c.kill(sig);
+    } catch {
+    }
+  };
+  let stopping = false;
+  const stopAll = (exitCode = 0) => {
+    if (stopping) return;
+    stopping = true;
+    try {
+      instanceLog.end();
+    } catch {
     }
+    for (const c of children) killTree(c, "SIGTERM");
+    setTimeout(() => {
+      for (const c of children) killTree(c, "SIGKILL");
+      process.exit(exitCode);
+    }, 1500);
   };
   let dashboardUrl = null;
   if (opts.ui !== false) {
+    if (source) process.env.OPENSHIP_DASHBOARD_DIR = source.dashboardDir;
     const uiSpinner = ora("Preparing the dashboard\u2026").start();
     try {
       const bundle = await ensureDashboard({
-        tag: opts.uiVersion || `v${"0.2.1"}`,
+        tag: source ? "local" : opts.uiVersion || `v${"0.2.3"}`,
         onProgress: (received, total) => {
           if (total) {
             uiSpinner.text = `Downloading dashboard\u2026 ${Math.round(received / total * 100)}%`;
@@ -2930,8 +3848,9 @@ async function runForeground(opts) {
         }
       });
       uiSpinner.text = "Starting the dashboard\u2026";
-      const dash = spawn(process.execPath, [bundle.entry], {
+      const dash = spawn2(process.execPath, [bundle.entry], {
         cwd: bundle.cwd,
+        detached: process.platform !== "win32",
         env: {
           ...process.env,
           NODE_ENV: "production",
@@ -2946,13 +3865,24 @@ async function runForeground(opts) {
           // the browser never needs to know where the API lives. Set in every
           // mode; loopback because the dashboard runs on the same box.
           INTERNAL_API_URL: `http://127.0.0.1:${port}`,
-          // Public URL feeds the SSR proxy-origin resolver; local mode keeps
-          // the window.__OPENSHIP_API_ORIGIN__ fallback for direct API calls.
-          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : { OPENSHIP_LOCAL_API_URL: `http://127.0.0.1:${port}` }
+          // ALWAYS tell the dashboard the real loopback API origin. The API port
+          // is dynamic, so a browser opened on THIS box must learn it via
+          // window.__OPENSHIP_API_ORIGIN__ (layout.tsx) — otherwise it falls back
+          // to the static default :4000 and every call 404s. Use `localhost` (NOT
+          // 127.0.0.1) to MATCH the host the dashboard is opened on — a host-only
+          // SameSite session cookie set on 127.0.0.1 is never sent to localhost
+          // (they're different sites to a browser), which is the login-reload loop.
+          // Older dashboards use this origin verbatim; newer ones align it anyway.
+          // `localhost` still reaches the 127.0.0.1-bound API. In proxy mode this
+          // is just a fallback (sameOriginProxyOrigin wins for remote browsers).
+          OPENSHIP_LOCAL_API_URL: `http://localhost:${port}`,
+          ...publicUrl ? { OPENSHIP_PUBLIC_URL: publicUrl } : {}
         },
         stdio: ["ignore", "pipe", "pipe"]
       });
       children.push(dash);
+      dash.stdout.on("data", (d) => instanceLog.write(d));
+      dash.stderr.on("data", (d) => instanceLog.write(d));
       let dashBuf = "";
       const onDash = (d) => {
         dashBuf += d.toString();
@@ -3009,12 +3939,9 @@ async function runForeground(opts) {
   child.stderr.off("data", buffer);
   child.stdout.on("data", (d) => process.stdout.write(d));
   child.stderr.on("data", (d) => process.stderr.write(d));
-  process.on("SIGINT", stopAll);
-  process.on("SIGTERM", stopAll);
-  child.on("exit", (code) => {
-    stopAll();
-    process.exit(code ?? 0);
-  });
+  process.on("SIGINT", () => stopAll(0));
+  process.on("SIGTERM", () => stopAll(0));
+  child.on("exit", (code) => stopAll(code ?? 0));
 }
 
 // src/commands/stop.ts
@@ -3035,15 +3962,15 @@ var stopCommand = new Command5("stop").description("Stop the Openship service (s
 
 // src/commands/init.ts
 import { Command as Command6 } from "commander";
-import { existsSync as existsSync5, mkdirSync as mkdirSync6, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync7, mkdirSync as mkdirSync8, writeFileSync as writeFileSync6 } from "fs";
 import { createInterface as createInterface2 } from "readline/promises";
 import { stdin as input2, stdout as output2 } from "process";
-import { join as join6 } from "path";
+import { join as join8 } from "path";
 var initCommand = new Command6("init").description("Link the current directory to an Openship project (.openship/project.json)").option("--project <id>", "Project id to link (skips the picker)").option("--environment <name>", "Default deploy environment", "production").option("--dir <path>", "Directory to initialize", process.cwd()).option("--force", "Overwrite an existing project link").option("-y, --yes", "Non-interactive: fail instead of prompting").action(async (opts) => {
   const root = opts.dir || process.cwd();
-  const linkDir = join6(root, ".openship");
-  const linkPath = join6(linkDir, "project.json");
-  if (existsSync5(linkPath) && !opts.force) {
+  const linkDir = join8(root, ".openship");
+  const linkPath = join8(linkDir, "project.json");
+  if (existsSync7(linkPath) && !opts.force) {
     err(`Already linked (${linkPath}). Re-run with --force to overwrite.`);
     process.exit(1);
   }
@@ -3096,19 +4023,97 @@ var initCommand = new Command6("init").description("Link the current directory t
     context: getActiveContext(),
     defaults: { environment: opts.environment || "production" }
   };
-  mkdirSync6(linkDir, { recursive: true });
-  writeFileSync5(linkPath, JSON.stringify(link, null, 2) + "\n");
+  mkdirSync8(linkDir, { recursive: true });
+  writeFileSync6(linkPath, JSON.stringify(link, null, 2) + "\n");
   if (isJsonMode()) {
     printJson({ path: linkPath, link });
     return;
   }
   ok(`
-  Linked ${link.name ?? link.projectId} \u2192 ${linkPath}
+  Linked ${link.name ?? link.projectId} \u2192 ${linkPath}
+`);
+});
+
+// src/commands/config.ts
+import { Command as Command7 } from "commander";
+import { existsSync as existsSync8, readFileSync as readFileSync5, writeFileSync as writeFileSync7 } from "fs";
+import { join as join9 } from "path";
+var SCHEMA_URL = "https://openship.io/openship.schema.json";
+var CONFIG_FILE = "openship.json";
+function detectHints(dir) {
+  const hints = {};
+  const lock = [
+    ["pnpm-lock.yaml", "pnpm"],
+    ["yarn.lock", "yarn"],
+    ["bun.lockb", "bun"],
+    ["package-lock.json", "npm"]
+  ];
+  for (const [file, pm] of lock) {
+    if (existsSync8(join9(dir, file))) {
+      hints.packageManager = pm;
+      break;
+    }
+  }
+  const pkgPath = join9(dir, "package.json");
+  if (existsSync8(pkgPath)) {
+    try {
+      const pkg = JSON.parse(readFileSync5(pkgPath, "utf8"));
+      const runner = hints.packageManager ?? "npm";
+      const exec = runner === "npm" ? "npm run" : runner;
+      if (pkg.scripts?.build) hints.buildCommand = `${exec} build`;
+      if (pkg.scripts?.start) hints.startCommand = `${exec} start`;
+    } catch {
+    }
+  }
+  return hints;
+}
+var initCmd = new Command7("init").description("Scaffold an openship.json in the current directory").option("--dir <path>", "Directory to write into", process.cwd()).option("--force", "Overwrite an existing openship.json").action((opts) => {
+  const dir = opts.dir || process.cwd();
+  const path2 = join9(dir, CONFIG_FILE);
+  if (existsSync8(path2) && !opts.force) {
+    err(`${CONFIG_FILE} already exists. Re-run with --force to overwrite.`);
+    process.exit(1);
+  }
+  const hints = detectHints(dir);
+  const scaffold = { $schema: SCHEMA_URL, ...hints };
+  const text2 = JSON.stringify(scaffold, null, 2) + "\n";
+  writeFileSync7(path2, text2);
+  if (isJsonMode()) {
+    printJson({ path: path2, config: scaffold });
+    return;
+  }
+  ok(`
+  Wrote ${CONFIG_FILE} \u2192 ${path2}`);
+  info("  Edit it to declare framework, env, domains, resources, services\u2026 then `openship config validate`.\n");
+});
+var validateCmd = new Command7("validate").description("Validate an openship.json against the deploy schema").argument("[file]", "Path to the config file", CONFIG_FILE).action((file) => {
+  const path2 = file === CONFIG_FILE ? join9(process.cwd(), CONFIG_FILE) : file;
+  if (!existsSync8(path2)) {
+    if (isJsonMode()) printJson({ valid: false, errors: [`${path2} not found`], warnings: [] });
+    else err(`Not found: ${path2}`);
+    process.exit(1);
+  }
+  const { config, errors, warnings } = parseOpenshipConfigJson(readFileSync5(path2, "utf8"));
+  const valid = errors.length === 0 && config !== null;
+  if (isJsonMode()) {
+    printJson({ valid, errors, warnings });
+    process.exit(valid ? 0 : 1);
+  }
+  for (const w of warnings) info(`  \u26A0 ${w}`);
+  if (!valid) {
+    err(`
+  ${errors.length} error${errors.length === 1 ? "" : "s"} in ${CONFIG_FILE}:`);
+    for (const e of errors) err(`    \u2022 ${e}`);
+    process.exit(1);
+  }
+  ok(`
+  ${CONFIG_FILE} is valid${warnings.length ? ` (${warnings.length} warning${warnings.length === 1 ? "" : "s"})` : ""}.
 `);
 });
+var configCommand = new Command7("config").description("Author and validate openship.json (declarative deploy config)").addCommand(initCmd).addCommand(validateCmd);
 
 // src/commands/context.ts
-import { Command as Command7 } from "commander";
+import { Command as Command8 } from "commander";
 function renderContexts() {
   const rows = listContexts().map((c) => ({
     current: c.current ? "*" : "",
@@ -3119,8 +4124,8 @@ function renderContexts() {
   }));
   printTable(rows, ["current", "name", "apiUrl", "dashboardUrl", "auth"]);
 }
-var listCmd = new Command7("list").alias("ls").description("List configured contexts").action(renderContexts);
-var useCmd = new Command7("use").description("Switch the active context").argument("<name>", "Context name").action((name) => {
+var listCmd = new Command8("list").alias("ls").description("List configured contexts").action(renderContexts);
+var useCmd = new Command8("use").description("Switch the active context").argument("<name>", "Context name").action((name) => {
   try {
     setActiveContext(name);
     ok(`
@@ -3131,7 +4136,7 @@ var useCmd = new Command7("use").description("Switch the active context").argume
     process.exit(1);
   }
 });
-var addCmd = new Command7("add").description("Create or update a context's endpoints/token").argument("<name>", "Context name").option("--api-url <url>", "API base URL").option("--dashboard-url <url>", "Dashboard base URL").option("--token <token>", "Personal Access Token to store").option("--use", "Switch to this context after adding").action((name, opts) => {
+var addCmd = new Command8("add").description("Create or update a context's endpoints/token").argument("<name>", "Context name").option("--api-url <url>", "API base URL").option("--dashboard-url <url>", "Dashboard base URL").option("--token <token>", "Personal Access Token to store").option("--use", "Switch to this context after adding").action((name, opts) => {
   addContext(name, {
     apiUrl: opts.apiUrl,
     dashboardUrl: opts.dashboardUrl,
@@ -3142,7 +4147,7 @@ var addCmd = new Command7("add").description("Create or update a context's endpo
   Saved context "${name}"${opts.use ? " (now active)" : ""}.
 `);
 });
-var rmCmd = new Command7("rm").alias("remove").description("Remove a context (cannot remove the active one)").argument("<name>", "Context name").action((name) => {
+var rmCmd = new Command8("rm").alias("remove").description("Remove a context (cannot remove the active one)").argument("<name>", "Context name").action((name) => {
   try {
     removeContext(name);
     ok(`
@@ -3153,47 +4158,61 @@ var rmCmd = new Command7("rm").alias("remove").description("Remove a context (ca
     process.exit(1);
   }
 });
-var contextCommand = new Command7("context").alias("ctx").description("Manage connection contexts (list/use/add/rm)").action(() => {
+var contextCommand = new Command8("context").alias("ctx").description("Manage connection contexts (list/use/add/rm)").action(() => {
   ok(`  Active context: ${getActiveContext()}`);
   renderContexts();
 }).addCommand(listCmd).addCommand(useCmd).addCommand(addCmd).addCommand(rmCmd);
 
 // src/commands/status.ts
-import { Command as Command8 } from "commander";
+import { Command as Command9 } from "commander";
 import chalk7 from "chalk";
-var statusCommand = new Command8("status").description("Show the active context's API health and deployment info").action(async () => {
+import { readFileSync as readFileSync6 } from "fs";
+import { homedir as homedir7 } from "os";
+import { join as join10 } from "path";
+function readPorts() {
+  try {
+    return JSON.parse(readFileSync6(join10(homedir7(), ".openship", "ports.json"), "utf8"));
+  } catch {
+    return {};
+  }
+}
+var statusCommand = new Command9("status").description("Show the local Openship service (installed/running, ports) and the active context's API health").action(async () => {
   const context = getActiveContext();
   const apiUrl = getApiUrl2();
-  let health;
-  let envInfo;
+  const svc = serviceStatus();
+  const ports = readPorts();
+  let health = null;
+  let envInfo = null;
+  let reachable = true;
+  let unreachableMsg = "";
   try {
     health = await apiRequest("/health", { signal: AbortSignal.timeout(8e3) });
     envInfo = await apiRequest("/health/env", { signal: AbortSignal.timeout(8e3) });
   } catch (e) {
-    if (isJsonMode()) {
-      printJson({ context, apiUrl, reachable: false });
-    } else {
-      const msg = e instanceof ApiError ? e.message : e.message;
-      err(`
-  Cannot reach the API at ${apiUrl}: ${msg}
-`);
-    }
-    process.exit(1);
+    reachable = false;
+    unreachableMsg = e instanceof ApiError ? e.message : e.message;
   }
   if (isJsonMode()) {
-    printJson({ context, apiUrl, reachable: true, health, env: envInfo });
-    return;
+    printJson({ context, apiUrl, service: svc, ports, reachable, health, env: envInfo });
+    process.exit(reachable ? 0 : 1);
   }
   const row = (label, value) => `  ${chalk7.dim(label.padEnd(14))}${value ?? chalk7.dim("-")}
 `;
-  process.stdout.write(
-    chalk7.bold("\n  Openship status\n\n") + row("Context", context) + row("API", apiUrl) + row("Health", chalk7.green(health.status ?? "ok")) + row("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row("Deploy", envInfo.deployMode) + row("Auth", envInfo.authMode) + row("Team", envInfo.teamMode) + (envInfo.hostDomain ? row("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row("Machine", envInfo.machineName) : "") + "\n"
-  );
+  const serviceState = svc.running ? chalk7.green("running") : svc.installed ? chalk7.yellow("installed \xB7 stopped") : chalk7.dim("not installed");
+  let out = chalk7.bold("\n  Openship status\n\n") + row("Service", serviceState) + row("Manager", svc.kind === "unsupported" ? chalk7.dim("none") : svc.kind) + (ports.api ? row("API port", ports.api) : "") + (ports.dashboard ? row("Dashboard port", ports.dashboard) : "") + row("Context", context) + row("API", apiUrl);
+  if (reachable && health && envInfo) {
+    out += row("Health", chalk7.green(health.status ?? "ok")) + row("Mode", envInfo.selfHosted ? "self-hosted" : "cloud") + row("Deploy", envInfo.deployMode) + row("Auth", envInfo.authMode) + row("Team", envInfo.teamMode) + (envInfo.hostDomain ? row("Host domain", envInfo.hostDomain) : "") + (envInfo.machineName ? row("Machine", envInfo.machineName) : "");
+  } else {
+    out += row("Health", chalk7.red("not reachable")) + chalk7.dim(`  ${unreachableMsg}
+`) + chalk7.dim(svc.running ? "  (service is up \u2014 it may still be starting)\n" : "  Start it with `openship up`.\n");
+  }
+  process.stdout.write(out + "\n");
+  if (!reachable) process.exit(1);
 });
 
 // src/commands/doctor.ts
-import { Command as Command9 } from "commander";
-import { existsSync as existsSync6 } from "fs";
+import { Command as Command10 } from "commander";
+import { existsSync as existsSync9 } from "fs";
 import { execFileSync } from "child_process";
 import chalk8 from "chalk";
 function bunVersion() {
@@ -3205,9 +4224,9 @@ function bunVersion() {
     return null;
   }
 }
-var doctorCommand = new Command9("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
+var doctorCommand = new Command10("doctor").description("Diagnose the CLI setup (config, active context, runtime)").action(async () => {
   const checks = [];
-  const hasConfig = existsSync6(CONFIG_PATH);
+  const hasConfig = existsSync9(CONFIG_PATH);
   checks.push({
     name: "config",
     status: hasConfig ? "pass" : "warn",
@@ -3255,20 +4274,20 @@ var doctorCommand = new Command9("doctor").description("Diagnose the CLI setup (
 });
 
 // src/commands/deploy.ts
-import { Command as Command10 } from "commander";
+import { Command as Command11 } from "commander";
 import { execFileSync as execFileSync3 } from "child_process";
 import ora2 from "ora";
 
 // src/lib/project-link.ts
-import { readFileSync as readFileSync3, existsSync as existsSync7 } from "fs";
-import { join as join7, dirname as dirname3, parse } from "path";
-var LINK_REL = join7(".openship", "project.json");
+import { readFileSync as readFileSync7, existsSync as existsSync10 } from "fs";
+import { join as join11, dirname as dirname3, parse } from "path";
+var LINK_REL = join11(".openship", "project.json");
 function findProjectLinkPath(from = process.cwd()) {
   let dir = from;
   const root = parse(dir).root;
   for (; ; ) {
-    const candidate = join7(dir, LINK_REL);
-    if (existsSync7(candidate)) return candidate;
+    const candidate = join11(dir, LINK_REL);
+    if (existsSync10(candidate)) return candidate;
     if (dir === root) return null;
     dir = dirname3(dir);
   }
@@ -3277,7 +4296,7 @@ function readProjectLink(from) {
   const path2 = findProjectLinkPath(from);
   if (!path2) return null;
   try {
-    return JSON.parse(readFileSync3(path2, "utf8"));
+    return JSON.parse(readFileSync7(path2, "utf8"));
   } catch {
     return null;
   }
@@ -3285,21 +4304,21 @@ function readProjectLink(from) {
 
 // src/lib/folder-deploy.ts
 import { execFileSync as execFileSync2 } from "child_process";
-import { readFileSync as readFileSync4, existsSync as existsSync8, rmSync as rmSync3 } from "fs";
+import { readFileSync as readFileSync8, existsSync as existsSync11, rmSync as rmSync3 } from "fs";
 import { tmpdir } from "os";
-import { join as join8, basename } from "path";
+import { join as join12, basename } from "path";
 function detectPackageManager(dir) {
-  if (existsSync8(join8(dir, "bun.lockb")) || existsSync8(join8(dir, "bun.lock"))) return "bun";
-  if (existsSync8(join8(dir, "pnpm-lock.yaml"))) return "pnpm";
-  if (existsSync8(join8(dir, "yarn.lock"))) return "yarn";
-  if (existsSync8(join8(dir, "package.json"))) return "npm";
+  if (existsSync11(join12(dir, "bun.lockb")) || existsSync11(join12(dir, "bun.lock"))) return "bun";
+  if (existsSync11(join12(dir, "pnpm-lock.yaml"))) return "pnpm";
+  if (existsSync11(join12(dir, "yarn.lock"))) return "yarn";
+  if (existsSync11(join12(dir, "package.json"))) return "npm";
   return void 0;
 }
 function detectStack(dir) {
-  if (existsSync8(join8(dir, "go.mod"))) return "go";
-  if (existsSync8(join8(dir, "Cargo.toml"))) return "rust";
-  if (existsSync8(join8(dir, "requirements.txt")) || existsSync8(join8(dir, "pyproject.toml"))) return "python";
-  if (existsSync8(join8(dir, "package.json"))) return "node";
+  if (existsSync11(join12(dir, "go.mod"))) return "go";
+  if (existsSync11(join12(dir, "Cargo.toml"))) return "rust";
+  if (existsSync11(join12(dir, "requirements.txt")) || existsSync11(join12(dir, "pyproject.toml"))) return "python";
+  if (existsSync11(join12(dir, "package.json"))) return "node";
   return void 0;
 }
 async function deployFolder(opts) {
@@ -3316,7 +4335,7 @@ async function deployFolder(opts) {
     throw new Error(session.error || "Failed to open upload session");
   }
   step("Packaging folder");
-  const tarball = join8(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
+  const tarball = join12(tmpdir(), `openship-upload-${session.sessionId}.tar.gz`);
   execFileSync2(
     "tar",
     [
@@ -3335,7 +4354,7 @@ async function deployFolder(opts) {
   );
   step("Uploading source");
   try {
-    const body = readFileSync4(tarball);
+    const body = readFileSync8(tarball);
     const up = session.upload;
     const method = up.method || "POST";
     const res = /^https?:\/\//i.test(up.url) ? await fetch(up.url, { method, headers: up.headers, body }) : await apiRaw(`/${up.url.replace(/^\/+/, "")}`, { method, headers: up.headers, body });
@@ -3516,7 +4535,7 @@ function git(args) {
     return void 0;
   }
 }
-var deployCommand = new Command10("deploy").description("Trigger a deployment for the current project").option("--project <id>", "Project ID (defaults to the linked project in .openship/project.json)").option("--branch <name>", "Git branch to deploy (defaults to the current branch)").option("--commit <sha>", "Specific commit SHA (defaults to the latest commit on the branch)").option("--env <environment>", "Target environment: production | preview", "production").option("--force-all", "Rebuild every enabled service (skip smart per-service routing)").option("--service-ids <ids>", "Comma-separated service IDs to deploy (smart routing)").option("--smart-route", "Rebuild only services changed since the active deploy").option("--refresh", "Re-apply current env to the active deploy (no git pull, no rebuild)").option("--name <name>", "Project name for a folder (non-git) deploy (defaults to the directory name)").option("--watch", "Stream the deployment logs until it finishes").action(async (opts) => {
+var deployCommand = new Command11("deploy").description("Trigger a deployment for the current project").option("--project <id>", "Project ID (defaults to the linked project in .openship/project.json)").option("--branch <name>", "Git branch to deploy (defaults to the current branch)").option("--commit <sha>", "Specific commit SHA (defaults to the latest commit on the branch)").option("--env <environment>", "Target environment: production | preview", "production").option("--force-all", "Rebuild every enabled service (skip smart per-service routing)").option("--service-ids <ids>", "Comma-separated service IDs to deploy (smart routing)").option("--smart-route", "Rebuild only services changed since the active deploy").option("--refresh", "Re-apply current env to the active deploy (no git pull, no rebuild)").option("--name <name>", "Project name for a folder (non-git) deploy (defaults to the directory name)").option("--watch", "Stream the deployment logs until it finishes").action(async (opts) => {
   const link = readProjectLink();
   const env = opts.env;
   if (env !== "production" && env !== "preview") {
@@ -3598,9 +4617,9 @@ var deployCommand = new Command10("deploy").description("Trigger a deployment fo
 });
 
 // src/commands/deployment.ts
-import { Command as Command11 } from "commander";
+import { Command as Command12 } from "commander";
 import { createInterface as createInterface3 } from "readline";
-function run2(fn) {
+function run3(fn) {
   return async (...args) => {
     try {
       await fn(...args);
@@ -3614,18 +4633,18 @@ function report(res, message) {
   if (isJsonMode()) printJson(res);
   else ok(message);
 }
-function shortSha(v) {
+function shortSha2(v) {
   return typeof v === "string" ? v.slice(0, 7) : "";
 }
 async function confirm(question) {
   if (!process.stdin.isTTY) return true;
   const rl = createInterface3({ input: process.stdin, output: process.stderr });
-  const answer = await new Promise((resolve2) => rl.question(`${question} [y/N] `, resolve2));
+  const answer = await new Promise((resolve3) => rl.question(`${question} [y/N] `, resolve3));
   rl.close();
   return /^y(es)?$/i.test(answer.trim());
 }
-var list = new Command11("list").description("List deployments (org-wide, or scoped to a project)").option("--project <id>", "Scope to a project (defaults to the linked project)").option("--env <environment>", "Filter by environment: production | preview").option("--limit <n>", "Max rows to fetch", "50").action(
-  run2(async (opts) => {
+var list = new Command12("list").description("List deployments (org-wide, or scoped to a project)").option("--project <id>", "Scope to a project (defaults to the linked project)").option("--env <environment>", "Filter by environment: production | preview").option("--limit <n>", "Max rows to fetch", "50").action(
+  run3(async (opts) => {
     const projectId = opts.project || readProjectLink()?.projectId;
     const params = new URLSearchParams();
     if (projectId) params.set("projectId", projectId);
@@ -3640,15 +4659,15 @@ var list = new Command11("list").description("List deployments (org-wide, or sco
       status: d.status,
       env: d.environment,
       branch: d.branch,
-      commit: shortSha(d.commitSha),
+      commit: shortSha2(d.commitSha),
       active: d.isActive ? "*" : "",
       created: d.createdAt
     }));
     printTable(rows, ["id", "status", "env", "branch", "commit", "active", "created"]);
   })
 );
-var get = new Command11("get").description("Show a single deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var get = new Command12("get").description("Show a single deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}`);
     const d = res.data ?? {};
     if (isJsonMode()) return printJson(d);
@@ -3668,20 +4687,20 @@ var get = new Command11("get").description("Show a single deployment").argument(
     );
   })
 );
-var info2 = new Command11("info").description("Show container info for a deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var info2 = new Command12("info").description("Show container info for a deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/info`);
     printJson(res.data ?? res);
   })
 );
-var usage = new Command11("usage").description("Show container resource usage for a deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var usage = new Command12("usage").description("Show container resource usage for a deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/usage`);
     printJson(res.data ?? res);
   })
 );
-var redeploy = new Command11("redeploy").description("Redeploy from an existing deployment").argument("<id>", "Deployment ID").option("--use-existing-commit", "Rebuild the same commit instead of the latest on the branch").action(
-  run2(async (id, opts) => {
+var redeploy = new Command12("redeploy").description("Redeploy from an existing deployment").argument("<id>", "Deployment ID").option("--use-existing-commit", "Rebuild the same commit instead of the latest on the branch").action(
+  run3(async (id, opts) => {
     const res = await apiRequest(`/deployments/${id}/redeploy`, {
       method: "POST",
       body: JSON.stringify({ useExistingCommit: opts.useExistingCommit === true })
@@ -3689,14 +4708,14 @@ var redeploy = new Command11("redeploy").description("Redeploy from an existing
     report(res, `Redeploy triggered for ${id}`);
   })
 );
-var rollback = new Command11("rollback").description("Roll back to a previous deployment").argument("<id>", "Deployment ID to roll back to").action(
-  run2(async (id) => {
+var rollback = new Command12("rollback").description("Roll back to a previous deployment").argument("<id>", "Deployment ID to roll back to").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/rollback`, { method: "POST" });
     report(res, `Rolled back to ${id}`);
   })
 );
-var pin = new Command11("pin").description("Pin (or unpin) a deployment's rollback artifact").argument("<id>", "Deployment ID").option("--off", "Unpin instead of pin").action(
-  run2(async (id, opts) => {
+var pin = new Command12("pin").description("Pin (or unpin) a deployment's rollback artifact").argument("<id>", "Deployment ID").option("--off", "Unpin instead of pin").action(
+  run3(async (id, opts) => {
     const pinned = !opts.off;
     const res = await apiRequest(`/deployments/${id}/pin`, {
       method: "POST",
@@ -3705,32 +4724,32 @@ var pin = new Command11("pin").description("Pin (or unpin) a deployment's rollba
     report(res, `${pinned ? "Pinned" : "Unpinned"} ${id}`);
   })
 );
-var cancel = new Command11("cancel").description("Cancel an in-progress deployment").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var cancel = new Command12("cancel").description("Cancel an in-progress deployment").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/cancel`, { method: "POST" });
     report(res, `Cancelled ${id}`);
   })
 );
-var restart2 = new Command11("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var restart2 = new Command12("restart").description("Restart a deployment's container").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/restart`, { method: "POST" });
     report(res, `Restarted ${id}`);
   })
 );
-var reject = new Command11("reject").description("Reject a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var reject = new Command12("reject").description("Reject a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/reject`, { method: "POST" });
     report(res, `Rejected ${id}`);
   })
 );
-var keep = new Command11("keep").description("Keep a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
-  run2(async (id) => {
+var keep = new Command12("keep").description("Keep a finished deployment awaiting a keep/reject decision").argument("<id>", "Deployment ID").action(
+  run3(async (id) => {
     const res = await apiRequest(`/deployments/${id}/keep`, { method: "POST" });
     report(res, `Kept ${id}`);
   })
 );
-var rm = new Command11("rm").description("Delete a deployment").argument("<id>", "Deployment ID").option("-y, --yes", "Skip the confirmation prompt").action(
-  run2(async (id, opts) => {
+var rm = new Command12("rm").description("Delete a deployment").argument("<id>", "Deployment ID").option("-y, --yes", "Skip the confirmation prompt").action(
+  run3(async (id, opts) => {
     if (!opts.yes && !isJsonMode() && !await confirm(`Delete deployment ${id}?`)) {
       err("Aborted.");
       process.exit(1);
@@ -3739,8 +4758,8 @@ var rm = new Command11("rm").description("Delete a deployment").argument("<id>",
     report(res, `Deleted ${id}`);
   })
 );
-var sslStatus = new Command11("status").description("Check SSL certificate status for a domain").argument("<domain>", "Domain to probe").action(
-  run2(async (domain) => {
+var sslStatus = new Command12("status").description("Check SSL certificate status for a domain").argument("<domain>", "Domain to probe").action(
+  run3(async (domain) => {
     const res = await apiRequest("/deployments/ssl/status", {
       method: "POST",
       body: JSON.stringify({ domain })
@@ -3748,8 +4767,8 @@ var sslStatus = new Command11("status").description("Check SSL certificate statu
     printJson(res);
   })
 );
-var sslRenew = new Command11("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
-  run2(async (domain, opts) => {
+var sslRenew = new Command12("renew").description("Renew (issue) an SSL certificate for a domain").argument("<domain>", "Domain to renew").option("--www", "Also include the www subdomain").action(
+  run3(async (domain, opts) => {
     const res = await apiRequest("/deployments/ssl/renew", {
       method: "POST",
       body: JSON.stringify({ domain, includeWww: opts.www === true })
@@ -3757,12 +4776,12 @@ var sslRenew = new Command11("renew").description("Renew (issue) an SSL certific
     report(res, `SSL renewal requested for ${domain}`);
   })
 );
-var ssl = new Command11("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
-var deploymentCommand = new Command11("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart2).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
+var ssl = new Command12("ssl").description("SSL certificate operations").addCommand(sslStatus).addCommand(sslRenew);
+var deploymentCommand = new Command12("deployment").alias("deployments").description("Manage deployments (list, inspect, redeploy, rollback, \u2026)").addCommand(list).addCommand(get).addCommand(info2).addCommand(usage).addCommand(redeploy).addCommand(rollback).addCommand(pin).addCommand(cancel).addCommand(restart2).addCommand(reject).addCommand(keep).addCommand(rm).addCommand(ssl);
 
 // src/commands/logs.ts
-import { Command as Command12 } from "commander";
-var logsCommand = new Command12("logs").description("View or stream a deployment's logs").argument("<deploymentId>", "Deployment ID").option("-f, --follow", "Stream live logs via SSE until the deployment finishes").option("--tail <n>", "Show only the last N log lines (snapshot mode)").action(async (deploymentId, opts) => {
+import { Command as Command13 } from "commander";
+var logsCommand = new Command13("logs").description("View or stream a deployment's logs").argument("<deploymentId>", "Deployment ID").option("-f, --follow", "Stream live logs via SSE until the deployment finishes").option("--tail <n>", "Show only the last N log lines (snapshot mode)").action(async (deploymentId, opts) => {
   if (opts.follow) {
     try {
       const result = await streamDeploymentLogs(deploymentId);
@@ -3794,7 +4813,7 @@ var logsCommand = new Command12("logs").description("View or stream a deployment
 });
 
 // src/commands/project.ts
-import { Command as Command13 } from "commander";
+import { Command as Command14 } from "commander";
 import chalk9 from "chalk";
 import { createInterface as createInterface4 } from "readline/promises";
 import { stdin as input3, stdout as output3 } from "process";
@@ -3831,7 +4850,7 @@ function printProject(project) {
   }
 }
 var ENVIRONMENTS = ["production", "preview", "development"];
-var listCmd2 = new Command13("list").alias("ls").description("List projects in the active organization").action(
+var listCmd2 = new Command14("list").alias("ls").description("List projects in the active organization").action(
   action(async () => {
     const rows = [];
     for await (const p of paginate("/projects")) {
@@ -3846,7 +4865,7 @@ var listCmd2 = new Command13("list").alias("ls").description("List projects in t
     printTable(rows, ["id", "name", "slug", "repo", "source"]);
   })
 );
-var getCmd = new Command13("get").description("Show a single project").argument("<id>", "Project ID").action(
+var getCmd = new Command14("get").description("Show a single project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const { data } = await apiRequest(
       `/projects/${encodeURIComponent(id)}`
@@ -3854,7 +4873,7 @@ var getCmd = new Command13("get").description("Show a single project").argument(
     printProject(data);
   })
 );
-var createCmd = new Command13("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--slug <slug>", "Free-subdomain slug (slug.opsh.io)").option("--git-owner <owner>", "GitHub owner/org").option("--git-repo <repo>", "GitHub repository name").option("--git-branch <branch>", "Git branch to deploy").option("--framework <framework>", "Stack/framework id").option("--local-path <path>", "Local source path").option("--port <port>", "Container port", (v) => Number(v)).option(
+var createCmd = new Command14("create").description("Create a project").requiredOption("--name <name>", "Project name").option("--slug <slug>", "Free-subdomain slug (slug.opsh.io)").option("--git-owner <owner>", "GitHub owner/org").option("--git-repo <repo>", "GitHub repository name").option("--git-branch <branch>", "Git branch to deploy").option("--framework <framework>", "Stack/framework id").option("--local-path <path>", "Local source path").option("--port <port>", "Container port", (v) => Number(v)).option(
   "--type <type>",
   "Project type: app | docker | services | monorepo"
 ).action(
@@ -3878,7 +4897,7 @@ var createCmd = new Command13("create").description("Create a project").required
     printProject(data);
   })
 );
-var deleteCmd = new Command13("delete").alias("rm").description("Delete a project (tears down all resources)").argument("<id>", "Project ID").option("--force", "Cancel active work and delete anyway").option("--force-orphan", "Orphan resources that won't destroy, then drop the row").option("--wipe-volumes", "Also destroy persistent volumes").option("-y, --yes", "Skip the confirmation prompt").action(
+var deleteCmd = new Command14("delete").alias("rm").description("Delete a project (tears down all resources)").argument("<id>", "Project ID").option("--force", "Cancel active work and delete anyway").option("--force-orphan", "Orphan resources that won't destroy, then drop the row").option("--wipe-volumes", "Also destroy persistent volumes").option("-y, --yes", "Skip the confirmation prompt").action(
   action(async (id, opts) => {
     if (!opts.yes) {
       const rl = createInterface4({ input: input3, output: output3 });
@@ -3909,7 +4928,7 @@ var deleteCmd = new Command13("delete").alias("rm").description("Delete a projec
 `);
   })
 );
-var envCmd = new Command13("env").description("Manage project environment variables");
+var envCmd = new Command14("env").description("Manage project environment variables");
 envCmd.command("get").description("List env vars (secret values are masked by the API)").argument("<id>", "Project ID").option("--environment <env>", "Filter by environment (production|preview|development)").action(
   action(async (id, opts) => {
     const qs = opts.environment ? `?environment=${encodeURIComponent(opts.environment)}` : "";
@@ -3983,7 +5002,7 @@ envCmd.command("set").description("Merge env vars: upsert KEY=VALUE pairs and/or
     );
   })
 );
-var gitCmd = new Command13("git").description("Manage git linkage and auto-deploy");
+var gitCmd = new Command14("git").description("Manage git linkage and auto-deploy");
 gitCmd.command("link").description("Link a GitHub repository to a project").argument("<id>", "Project ID").requiredOption("--owner <owner>", "GitHub owner/org").requiredOption("--repo <repo>", "Repository name").option("--branch <branch>", "Branch (defaults to the repo's default branch)").option("--installation-id <id>", "GitHub App installation id", (v) => Number(v)).action(
   action(async (id, opts) => {
     const result = await apiRequest(
@@ -4071,7 +5090,7 @@ gitCmd.command("webhook-domain").description("Set or clear the domain that recei
 `);
   })
 );
-var connectCmd = new Command13("connect").description("Connect a custom domain to a project").argument("<id>", "Project ID").argument("<domain>", "Custom domain hostname").option("--include-www", "Also connect the www. variant").action(
+var connectCmd = new Command14("connect").description("Connect a custom domain to a project").argument("<id>", "Project ID").argument("<domain>", "Custom domain hostname").option("--include-www", "Also connect the www. variant").action(
   action(async (id, domain, opts) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/connect`,
@@ -4091,7 +5110,7 @@ var connectCmd = new Command13("connect").description("Connect a custom domain t
     printJson(result.records);
   })
 );
-var enableCmd = new Command13("enable").description("Start a stopped project").argument("<id>", "Project ID").action(
+var enableCmd = new Command14("enable").description("Start a stopped project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/enable`,
@@ -4103,7 +5122,7 @@ var enableCmd = new Command13("enable").description("Start a stopped project").a
 `);
   })
 );
-var disableCmd = new Command13("disable").description("Stop a running project").argument("<id>", "Project ID").action(
+var disableCmd = new Command14("disable").description("Stop a running project").argument("<id>", "Project ID").action(
   action(async (id) => {
     const result = await apiRequest(
       `/projects/${encodeURIComponent(id)}/disable`,
@@ -4116,7 +5135,7 @@ var disableCmd = new Command13("disable").description("Stop a running project").
   })
 );
 var SLEEP_MODES = ["auto_sleep", "always_on"];
-var sleepModeCmd = new Command13("sleep-mode").description("Set the project sleep mode").argument("<id>", "Project ID").argument("<mode>", `One of: ${SLEEP_MODES.join(", ")}`).action(
+var sleepModeCmd = new Command14("sleep-mode").description("Set the project sleep mode").argument("<id>", "Project ID").argument("<mode>", `One of: ${SLEEP_MODES.join(", ")}`).action(
   action(async (id, mode) => {
     if (!SLEEP_MODES.includes(mode)) {
       err(`  mode must be one of: ${SLEEP_MODES.join(", ")}`);
@@ -4134,7 +5153,7 @@ var sleepModeCmd = new Command13("sleep-mode").description("Set the project slee
   })
 );
 var TRANSFER_DIRS = ["to-cloud", "to-self-hosted"];
-var transferCmd = new Command13("transfer").description("Promote a project to Openship Cloud, or bring it back (self-hosted only)").argument("<id>", "Project ID").argument("<direction>", `One of: ${TRANSFER_DIRS.join(", ")}`).action(
+var transferCmd = new Command14("transfer").description("Promote a project to Openship Cloud, or bring it back (self-hosted only)").argument("<id>", "Project ID").argument("<direction>", `One of: ${TRANSFER_DIRS.join(", ")}`).action(
   action(async (id, direction) => {
     if (!TRANSFER_DIRS.includes(direction)) {
       err(`  direction must be one of: ${TRANSFER_DIRS.join(", ")}`);
@@ -4157,7 +5176,7 @@ var transferCmd = new Command13("transfer").description("Promote a project to Op
     );
   })
 );
-var logsCmd = new Command13("logs").description("Show or stream runtime (container) logs").argument("<id>", "Project ID").option("--tail <n>", "Number of recent lines", (v) => Number(v)).option("-f, --follow", "Stream logs until interrupted").action(
+var logsCmd = new Command14("logs").description("Show or stream runtime (container) logs").argument("<id>", "Project ID").option("--tail <n>", "Number of recent lines", (v) => Number(v)).option("-f, --follow", "Stream logs until interrupted").action(
   action(async (id, opts) => {
     const tailQs = opts.tail ? `?tail=${opts.tail}` : "";
     if (!opts.follow) {
@@ -4185,7 +5204,7 @@ var logsCmd = new Command13("logs").description("Show or stream runtime (contain
     }
   })
 );
-var serverLogsCmd = new Command13("server-logs").description("Show or stream HTTP request logs (edge/OpenResty)").argument("<id>", "Project ID").option("--limit <n>", "Number of recent entries (max 200)", (v) => Number(v)).option("--domain <domain>", "Restrict to a specific domain").option("-f, --follow", "Stream request logs until interrupted").action(
+var serverLogsCmd = new Command14("server-logs").description("Show or stream HTTP request logs (edge/OpenResty)").argument("<id>", "Project ID").option("--limit <n>", "Number of recent entries (max 200)", (v) => Number(v)).option("--domain <domain>", "Restrict to a specific domain").option("-f, --follow", "Stream request logs until interrupted").action(
   action(async (id, opts) => {
     const base = `/projects/${encodeURIComponent(id)}/server-logs`;
     const domainQs = opts.domain ? `domain=${encodeURIComponent(opts.domain)}` : "";
@@ -4233,7 +5252,7 @@ function printLogEntry(entry) {
   process.stdout.write(`  ${ts} ${color(level.padEnd(5))} ${String(msg)}
 `);
 }
-var projectCommand = new Command13("project").alias("projects").description("Manage Openship projects");
+var projectCommand = new Command14("project").alias("projects").description("Manage Openship projects");
 projectCommand.addCommand(listCmd2);
 projectCommand.addCommand(getCmd);
 projectCommand.addCommand(createCmd);
@@ -4249,9 +5268,9 @@ projectCommand.addCommand(logsCmd);
 projectCommand.addCommand(serverLogsCmd);
 
 // src/commands/service.ts
-import { Command as Command14 } from "commander";
+import { Command as Command15 } from "commander";
 import chalk10 from "chalk";
-import { spawnSync as spawnSync3 } from "child_process";
+import { spawnSync as spawnSync4 } from "child_process";
 import path from "path";
 import { createInterface as createInterface5 } from "readline/promises";
 import { stdin as input4, stdout as output4 } from "process";
@@ -4270,7 +5289,7 @@ function fail(e) {
   process.exit(1);
 }
 function stackCommand(name) {
-  return new Command14(name).requiredOption(
+  return new Command15(name).requiredOption(
     "-p, --project <id|slug|name>",
     "Stack (project) id, slug, or name"
   );
@@ -4518,7 +5537,7 @@ function mapComposeService(name, def, baseDir) {
 var syncCmd = stackCommand("sync").description("Sync a stack's services from a docker-compose file (services not in the file are removed)").argument("<compose-file>", "Path to docker-compose.yml / compose.yaml").option("-y, --yes", "Skip the confirmation prompt").action(async (composeFile, opts) => {
   requireAuth();
   const abs = path.resolve(composeFile);
-  const proc = spawnSync3(
+  const proc = spawnSync4(
     "docker",
     ["compose", "-f", abs, "config", "--format", "json"],
     { encoding: "utf8", maxBuffer: 64 * 1024 * 1024 }
@@ -4612,7 +5631,7 @@ var containersCmd = stackCommand("containers").description("List the stack's act
     fail(e);
   }
 });
-var driftCmd = new Command14("drift").description(
+var driftCmd = new Command15("drift").description(
   "Resolve compose drift on a service (upstream compose changed a value you edited)"
 );
 function driftActionCommand(action2) {
@@ -4640,7 +5659,7 @@ function driftActionCommand(action2) {
 }
 driftCmd.addCommand(driftActionCommand("accept"));
 driftCmd.addCommand(driftActionCommand("keep"));
-var envCmd2 = new Command14("env").description("Read and write a service's environment variables");
+var envCmd2 = new Command15("env").description("Read and write a service's environment variables");
 var envGetCmd = stackCommand("get").description("List a service's environment variables (secrets masked)").argument("<service>", "Service name or id").option("-e, --env <environment>", "Environment: production | preview | development").action(async (service, opts) => {
   requireAuth();
   try {
@@ -4773,7 +5792,7 @@ var execCmd = stackCommand("exec").description("Open an interactive shell in a s
   );
   process.exit(1);
 });
-var serviceCommand = new Command14("service").alias("services").description("Manage the services in a compose stack (a multi-service project)");
+var serviceCommand = new Command15("service").alias("services").description("Manage the services in a compose stack (a multi-service project)");
 serviceCommand.addCommand(listCmd3);
 serviceCommand.addCommand(getCmd2);
 serviceCommand.addCommand(createCmd2);
@@ -4789,7 +5808,7 @@ serviceCommand.addCommand(logsCmd2);
 serviceCommand.addCommand(execCmd);
 
 // src/commands/domain.ts
-import { Command as Command15 } from "commander";
+import { Command as Command16 } from "commander";
 import chalk11 from "chalk";
 import ora3 from "ora";
 function spin(text2) {
@@ -4825,7 +5844,7 @@ function printRecords(result) {
     ["type", "host", "value"]
   );
 }
-var listCmd4 = new Command15("list").description("List a project's custom domains").requiredOption("-p, --project <id>", "Project ID to list domains for").action(async (opts) => {
+var listCmd4 = new Command16("list").description("List a project's custom domains").requiredOption("-p, --project <id>", "Project ID to list domains for").action(async (opts) => {
   try {
     const res = await apiRequest(
       `/domains?projectId=${encodeURIComponent(opts.project)}`
@@ -4840,7 +5859,7 @@ var listCmd4 = new Command15("list").description("List a project's custom domain
     fail2(e);
   }
 });
-var addCmd2 = new Command15("add").description("Add a custom domain to a project").argument("<hostname>", "Domain hostname (e.g. app.example.com)").requiredOption("-p, --project <id>", "Project ID to attach the domain to").option("--primary", "Mark this domain as the project's primary", false).action(async (hostname, opts) => {
+var addCmd2 = new Command16("add").description("Add a custom domain to a project").argument("<hostname>", "Domain hostname (e.g. app.example.com)").requiredOption("-p, --project <id>", "Project ID to attach the domain to").option("--primary", "Mark this domain as the project's primary", false).action(async (hostname, opts) => {
   const sp = spin(`Adding ${hostname}\u2026`);
   try {
     const res = await apiRequest("/domains", {
@@ -4859,7 +5878,7 @@ var addCmd2 = new Command15("add").description("Add a custom domain to a project
     fail2(e);
   }
 });
-var previewCmd = new Command15("preview").description("Preview the DNS records a hostname would need (no changes saved)").argument("<hostname>", "Domain hostname to preview").action(async (hostname) => {
+var previewCmd = new Command16("preview").description("Preview the DNS records a hostname would need (no changes saved)").argument("<hostname>", "Domain hostname to preview").action(async (hostname) => {
   try {
     const res = await apiRequest("/domains/preview", {
       method: "POST",
@@ -4870,7 +5889,7 @@ var previewCmd = new Command15("preview").description("Preview the DNS records a
     fail2(e);
   }
 });
-var verifyCmd = new Command15("verify").description("Run DNS verification for a domain").argument("<id>", "Domain ID").action(async (id) => {
+var verifyCmd = new Command16("verify").description("Run DNS verification for a domain").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Checking DNS records\u2026");
   try {
     const res = await apiRaw(`/domains/${encodeURIComponent(id)}/verify`, { method: "POST" });
@@ -4896,7 +5915,7 @@ var verifyCmd = new Command15("verify").description("Run DNS verification for a
     fail2(e);
   }
 });
-var primaryCmd = new Command15("primary").description("Make a domain the project's primary hostname").argument("<id>", "Domain ID").action(async (id) => {
+var primaryCmd = new Command16("primary").description("Make a domain the project's primary hostname").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Setting primary\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/primary`, {
@@ -4909,7 +5928,7 @@ var primaryCmd = new Command15("primary").description("Make a domain the project
     fail2(e);
   }
 });
-var recordsCmd = new Command15("records").description("Show the DNS records for an existing domain").argument("<id>", "Domain ID").action(async (id) => {
+var recordsCmd = new Command16("records").description("Show the DNS records for an existing domain").argument("<id>", "Domain ID").action(async (id) => {
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/records`);
     printRecords(res.data);
@@ -4927,7 +5946,7 @@ function printSsl(data) {
   if (data.issuer) info(`  issuer:  ${data.issuer}`);
   if (data.expiresAt) info(`  expires: ${data.expiresAt}`);
 }
-var renewCmd = new Command15("renew").description("Renew the SSL certificate for a domain").argument("<id>", "Domain ID").action(async (id) => {
+var renewCmd = new Command16("renew").description("Renew the SSL certificate for a domain").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Renewing certificate\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/renew`, {
@@ -4940,7 +5959,7 @@ var renewCmd = new Command15("renew").description("Renew the SSL certificate for
     fail2(e);
   }
 });
-var verifySslCmd = new Command15("verify-ssl").description("Recheck that a domain's SSL certificate is issued and valid (no reissue)").argument("<id>", "Domain ID").action(async (id) => {
+var verifySslCmd = new Command16("verify-ssl").description("Recheck that a domain's SSL certificate is issued and valid (no reissue)").argument("<id>", "Domain ID").action(async (id) => {
   const sp = spin("Checking certificate\u2026");
   try {
     const res = await apiRequest(`/domains/${encodeURIComponent(id)}/verify-ssl`, {
@@ -4955,7 +5974,7 @@ var verifySslCmd = new Command15("verify-ssl").description("Recheck that a domai
     fail2(e);
   }
 });
-var renewAllCmd = new Command15("renew-all").description("Renew SSL for every near-expiry domain in your organization").action(async () => {
+var renewAllCmd = new Command16("renew-all").description("Renew SSL for every near-expiry domain in your organization").action(async () => {
   const sp = spin("Renewing expiring certificates\u2026");
   try {
     const res = await apiRequest("/domains/renew-all", { method: "POST" });
@@ -4977,10 +5996,10 @@ var renewAllCmd = new Command15("renew-all").description("Renew SSL for every ne
     fail2(e);
   }
 });
-var domainCommand = new Command15("domain").description("Manage custom domains, DNS verification, and SSL certificates").addCommand(listCmd4).addCommand(addCmd2).addCommand(previewCmd).addCommand(verifyCmd).addCommand(primaryCmd).addCommand(recordsCmd).addCommand(renewCmd).addCommand(verifySslCmd).addCommand(renewAllCmd);
+var domainCommand = new Command16("domain").description("Manage custom domains, DNS verification, and SSL certificates").addCommand(listCmd4).addCommand(addCmd2).addCommand(previewCmd).addCommand(verifyCmd).addCommand(primaryCmd).addCommand(recordsCmd).addCommand(renewCmd).addCommand(verifySslCmd).addCommand(renewAllCmd);
 
 // src/commands/server.ts
-import { Command as Command16 } from "commander";
+import { Command as Command17 } from "commander";
 import chalk12 from "chalk";
 import ora4 from "ora";
 var INSTALLABLE = ["docker", "git", "openresty", "certbot", "rsync"];
@@ -5013,7 +6032,7 @@ function connBody(o) {
     sshArgs: o.sshArgs
   };
 }
-var server = new Command16("server").description("Manage self-hosted SSH servers");
+var server = new Command17("server").description("Manage self-hosted SSH servers");
 server.command("list").alias("ls").description("List servers in the active organization").action(
   guard(async () => {
     const servers = await apiRequest("/system/servers");
@@ -5091,6 +6110,50 @@ server.command("check <serverId>").description("Run component health checks agai
     else err(`  Missing required components: ${res.missing.join(", ") || "none"}`);
   })
 );
+server.command("update <serverId>").description("Check for and apply native-module migrations (OpenResty, \u2026)").option("-c, --component <name...>", "Limit to specific modules").option("--check", "Only report drift; don't apply").action(
+  guard(async (serverId, o) => {
+    const base = `/system/servers/${encodeURIComponent(serverId)}/modules`;
+    await apiRequest(`${base}/scan`, { method: "POST", body: "{}" }).catch(() => {
+    });
+    let mods = await apiRequest(base);
+    if (o.component?.length) mods = mods.filter((m) => o.component.includes(m.moduleName));
+    if (o.check) {
+      if (isJsonMode()) return printJson(mods);
+      printTable(
+        mods.map((m) => ({
+          module: m.moduleName,
+          installed: m.installedVersion ?? "-",
+          current: m.migrationVersion ?? "-",
+          available: m.availableVersion ?? "-",
+          behind: m.behind ? "yes" : "no",
+          consent: String(m.detail?.pendingConsent?.length ?? 0)
+        })),
+        ["module", "installed", "current", "available", "behind", "consent"]
+      );
+      return;
+    }
+    const behind = mods.filter((m) => m.behind);
+    if (!behind.length) return ok("  All modules up to date.");
+    for (const m of behind) {
+      const consent = m.detail?.pendingConsent ?? [];
+      if (consent.length && !isJsonMode()) {
+        info(`  ${m.moduleName}: includes consent migrations \u2014 ${consent.map((c) => c.warning ?? c.id).join("; ")}`);
+      }
+      const spinner3 = isJsonMode() ? null : ora4(`Updating ${m.moduleName}\u2026`).start();
+      const res = await apiRequest(`${base}/${encodeURIComponent(m.moduleName)}/apply`, {
+        method: "POST",
+        body: "{}"
+      });
+      spinner3?.stop();
+      if (isJsonMode()) {
+        printJson(res);
+        continue;
+      }
+      if (res.ok) ok(`  ${m.moduleName}: ${res.fromVersion} \u2192 ${res.toVersion} (${res.appliedSteps.length} step(s))`);
+      else err(`  ${m.moduleName}: ${res.error ?? "update failed"}`);
+    }
+  })
+);
 server.command("install <serverId>").description("Install components on a server").requiredOption("-c, --component <name...>", `Components to install (${INSTALLABLE.join("|")})`).option("--follow", "Stream install logs live (SSE)").action(
   guard(async (serverId, o) => {
     const components = o.component;
@@ -5231,9 +6294,9 @@ function fmtUptime(seconds) {
 var serverCommand = server;
 
 // src/commands/system.ts
-import { Command as Command17 } from "commander";
+import { Command as Command18 } from "commander";
 import ora5 from "ora";
-import { readFileSync as readFileSync5, writeFileSync as writeFileSync6 } from "fs";
+import { readFileSync as readFileSync9, writeFileSync as writeFileSync8 } from "fs";
 import { createInterface as createInterface6 } from "readline/promises";
 import { stdin as input5, stdout as output5 } from "process";
 async function guarded(fn) {
@@ -5279,7 +6342,7 @@ async function promptHidden(query) {
   output5.write("\n");
   return answer;
 }
-var settingsCommand = new Command17("settings").description("Read or update instance settings");
+var settingsCommand = new Command18("settings").description("Read or update instance settings");
 settingsCommand.command("get").description("Show current instance settings").action(async () => {
   await guarded(async () => {
     const s = await apiRequest("/system/settings");
@@ -5318,7 +6381,7 @@ settingsCommand.command("set").description("Update instance-level settings").opt
 `));
   });
 });
-var onboardingCommand = new Command17("onboarding").description("First-run instance setup");
+var onboardingCommand = new Command18("onboarding").description("First-run instance setup");
 onboardingCommand.command("apply").description("Configure a fresh instance (fails once already configured)").option("--ssh-host <host>", "SSH host of the target server").option("--ssh-port <n>", "SSH port (default 22)").option("--ssh-user <user>", "SSH user (default root)").option("--ssh-auth-method <method>", "SSH auth method").option("--ssh-password <password>", "SSH password").option("--ssh-key-path <path>", "SSH private key path").option("--ssh-key-passphrase <pass>", "SSH key passphrase").option("--ssh-jump-host <host>", "SSH jump host").option("--ssh-args <args>", "Extra SSH args").option("--server-name <name>", "Display name for the server").option("--auth-mode <mode>", "Initial auth mode: none | local | cloud").option("--tunnel-provider <provider>", "Tunnel provider").option("--tunnel-token <token>", "Tunnel token").option("--default-build-mode <mode>", "Default build mode").option("--default-rollback-window <n>", "Default rollback window").action(async (opts) => {
   await guarded(async () => {
     const body = {
@@ -5352,7 +6415,7 @@ onboardingCommand.command("apply").description("Configure a fresh instance (fail
     }
   });
 });
-var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote a zero-auth instance to email/password login").option("--name <name>", "Account display name").option("--email <email>", "Account email").option("--password <password>", "Account password (prompted if omitted)").option("--use-own-mail-server", "Warm the self-hosted mail server for auth emails").action(async (opts) => {
+var upgradeToAuthCommand = new Command18("upgrade-to-auth").description("Promote a zero-auth instance to email/password login").option("--name <name>", "Account display name").option("--email <email>", "Account email").option("--password <password>", "Account password (prompted if omitted)").option("--use-own-mail-server", "Warm the self-hosted mail server for auth emails").action(async (opts) => {
   await guarded(async () => {
     const name = opts.name;
     const email = opts.email;
@@ -5381,7 +6444,7 @@ var upgradeToAuthCommand = new Command17("upgrade-to-auth").description("Promote
 `));
   });
 });
-var browseCommand = new Command17("browse").description("List directories on the instance host (defaults to home)").argument("[path]", "Directory to list").action(async (path2) => {
+var browseCommand = new Command18("browse").description("List directories on the instance host (defaults to home)").argument("[path]", "Directory to list").action(async (path2) => {
   await guarded(async () => {
     const qs = path2 ? `?path=${encodeURIComponent(path2)}` : "";
     const res = await apiRequest(`/system/browse${qs}`);
@@ -5410,7 +6473,7 @@ function buildDomain(opts) {
   err("\n  A domain is required: pass --hostname <host> or --slug <slug>.\n");
   process.exit(1);
 }
-var migrationCommand = new Command17("migration").description("Team-mode migration lifecycle");
+var migrationCommand = new Command18("migration").description("Team-mode migration lifecycle");
 migrationCommand.command("preflight").description("Read-only readiness check for the own-server migration").requiredOption("--server-id <id>", "Target server id").option("--hostname <host>", "Custom domain pointing at the server").option("--slug <slug>", "Free <slug>.opsh.io subdomain").action(async (opts) => {
   await guarded(async () => {
     const domain = buildDomain(opts);
@@ -5517,7 +6580,7 @@ migrationCommand.command("switch-back").description("Reverse migration back to s
     }
   });
 });
-var dataTransferCommand = new Command17("data-transfer").description(
+var dataTransferCommand = new Command18("data-transfer").description(
   "Whole-instance export / import (owner-only)"
 );
 dataTransferCommand.command("export").description("Export the entire instance to a JSON file").option("--passphrase <passphrase>", "Seal secrets under this passphrase").option("--out <file>", "Write the export to this file instead of stdout").action(async (opts) => {
@@ -5533,7 +6596,7 @@ dataTransferCommand.command("export").description("Export the entire instance to
       );
       spin4?.succeed("Export ready.");
       if (opts.out) {
-        writeFileSync6(opts.out, JSON.stringify(file));
+        writeFileSync8(opts.out, JSON.stringify(file));
         const tables = Object.keys(file.dump?.tables ?? {}).length;
         report2(
           { out: opts.out, tables },
@@ -5559,7 +6622,7 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
     let file;
     try {
-      file = JSON.parse(readFileSync5(opts.file, "utf8"));
+      file = JSON.parse(readFileSync9(opts.file, "utf8"));
     } catch {
       err(`
   Could not read or parse ${opts.file}.
@@ -5587,10 +6650,10 @@ dataTransferCommand.command("import").description("Import an instance export fil
     }
   });
 });
-var systemCommand = new Command17("system").description("Instance settings, onboarding, migration, and data transfer").addCommand(settingsCommand).addCommand(onboardingCommand).addCommand(upgradeToAuthCommand).addCommand(browseCommand).addCommand(migrationCommand).addCommand(dataTransferCommand);
+var systemCommand = new Command18("system").description("Instance settings, onboarding, migration, and data transfer").addCommand(settingsCommand).addCommand(onboardingCommand).addCommand(upgradeToAuthCommand).addCommand(browseCommand).addCommand(migrationCommand).addCommand(dataTransferCommand);
 
 // src/commands/mail.ts
-import { Command as Command18 } from "commander";
+import { Command as Command19 } from "commander";
 import chalk13 from "chalk";
 import ora6 from "ora";
 import { createInterface as createInterface7 } from "readline/promises";
@@ -5632,7 +6695,7 @@ function printRecordsObject(records) {
   if (rows.length === 0) return info("  (no DNS records)");
   printTable(rows, ["key", "type", "host", "value"]);
 }
-var stepsCmd = new Command18("steps").description("List the mail setup steps").action(
+var stepsCmd = new Command19("steps").description("List the mail setup steps").action(
   guard2(async () => {
     const res = await apiRequest(
       "/mail/steps"
@@ -5645,7 +6708,7 @@ var stepsCmd = new Command18("steps").description("List the mail setup steps").a
     info(`  ${res.total} steps total.`);
   })
 );
-var statusCmd = new Command18("status").description("Show the setup progress for a mail server").argument("[serverId]", "Mail server ID (omit for the empty welcome shell)").action(
+var statusCmd = new Command19("status").description("Show the setup progress for a mail server").argument("[serverId]", "Mail server ID (omit for the empty welcome shell)").action(
   guard2(async (serverId) => {
     const q = serverId ? `?serverId=${encodeURIComponent(serverId)}` : "";
     const res = await apiRequest(`/mail/status${q}`);
@@ -5666,7 +6729,7 @@ var statusCmd = new Command18("status").description("Show the setup progress for
     }
   })
 );
-var serversCmd = new Command18("servers").description("List every server the mail stack is installed on").action(
+var serversCmd = new Command19("servers").description("List every server the mail stack is installed on").action(
   guard2(async () => {
     const res = await apiRequest(
       "/mail/servers"
@@ -5687,7 +6750,7 @@ var serversCmd = new Command18("servers").description("List every server the mai
     );
   })
 );
-var scanCmd = new Command18("scan").description("Probe a server for an existing mail install (read-only)").argument("<serverId>", "Server ID to scan").action(
+var scanCmd = new Command19("scan").description("Probe a server for an existing mail install (read-only)").argument("<serverId>", "Server ID to scan").action(
   guard2(async (serverId) => {
     const sp = spin2("Scanning server\u2026");
     const res = await apiRequest("/mail/scan", { method: "POST", body: JSON.stringify({ serverId }) });
@@ -5702,7 +6765,7 @@ var scanCmd = new Command18("scan").description("Probe a server for an existing
     else info("  Nothing to adopt on this server.");
   })
 );
-var adoptCmd = new Command18("adopt").description("Re-adopt an existing mail install whose orchestrator state was lost").argument("<serverId>", "Server ID to adopt").action(
+var adoptCmd = new Command19("adopt").description("Re-adopt an existing mail install whose orchestrator state was lost").argument("<serverId>", "Server ID to adopt").action(
   guard2(async (serverId) => {
     const sp = spin2("Adopting mail server\u2026");
     const res = await apiRequest(
@@ -5715,7 +6778,7 @@ var adoptCmd = new Command18("adopt").description("Re-adopt an existing mail ins
     info(`  completed: ${res.completed ? "yes" : "no"}`);
   })
 );
-var setupCmd = new Command18("setup").description("Start or resume the mail setup wizard (streams over SSE)").argument("<serverId>", "Server ID to install the mail stack on").requiredOption("-d, --domain <domain>", "Mail domain (e.g. example.com)").option("--start-step <n>", "Resume from a specific step (1-13)").option("--config <json>", "iRedMail config overrides as a JSON object").action(
+var setupCmd = new Command19("setup").description("Start or resume the mail setup wizard (streams over SSE)").argument("<serverId>", "Server ID to install the mail stack on").requiredOption("-d, --domain <domain>", "Mail domain (e.g. example.com)").option("--start-step <n>", "Resume from a specific step (1-13)").option("--config <json>", "iRedMail config overrides as a JSON object").action(
   guard2(async (serverId, opts) => {
     let config;
     if (opts.config) {
@@ -5784,7 +6847,7 @@ var setupCmd = new Command18("setup").description("Start or resume the mail setu
     if (failed) process.exit(1);
   })
 );
-var cancelCmd = new Command18("cancel").description("Cancel the mail setup currently running").action(
+var cancelCmd = new Command19("cancel").description("Cancel the mail setup currently running").action(
   guard2(async () => {
     const res = await apiRequest("/mail/setup/cancel", {
       method: "POST"
@@ -5794,7 +6857,7 @@ var cancelCmd = new Command18("cancel").description("Cancel the mail setup curre
   })
 );
 function ackCommand(name, path2, description, successMsg) {
-  return new Command18(name).description(description).argument("<serverId>", "Mail server ID").action(
+  return new Command19(name).description(description).argument("<serverId>", "Mail server ID").action(
     guard2(async (serverId) => {
       const res = await apiRequest(path2, {
         method: "POST",
@@ -5817,7 +6880,7 @@ var ptrAckCmd = ackCommand(
   "Acknowledge that reverse DNS (PTR) is configured",
   "PTR acknowledged. Re-run `mail setup` with --start-step to continue."
 );
-var resetCmd = new Command18("reset").description("Wipe the on-server setup state file (does NOT touch installed daemons)").argument("<serverId>", "Mail server ID").option("-y, --yes", "Skip the confirmation prompt").action(
+var resetCmd = new Command19("reset").description("Wipe the on-server setup state file (does NOT touch installed daemons)").argument("<serverId>", "Mail server ID").option("-y, --yes", "Skip the confirmation prompt").action(
   guard2(async (serverId, opts) => {
     if (!opts.yes && !isJsonMode()) {
       const rl = createInterface7({ input: input6, output: output6 });
@@ -5833,7 +6896,7 @@ var resetCmd = new Command18("reset").description("Wipe the on-server setup stat
     ok("  Setup state reset.");
   })
 );
-var forgetCmd = new Command18("forget").description("Stop managing a mail server (drops the DB row; leaves the stack + state intact)").argument("<serverId>", "Mail server ID").action(
+var forgetCmd = new Command19("forget").description("Stop managing a mail server (drops the DB row; leaves the stack + state intact)").argument("<serverId>", "Mail server ID").action(
   guard2(async (serverId) => {
     const res = await apiRequest(`/mail/servers/${encodeURIComponent(serverId)}`, {
       method: "DELETE"
@@ -5842,7 +6905,7 @@ var forgetCmd = new Command18("forget").description("Stop managing a mail server
     ok(`  Forgot mail server ${serverId} (re-adopt with \`mail scan\` + \`mail adopt\`).`);
   })
 );
-var healthCmd = new Command18("health").description("Show live status of every mail daemon").argument("<serverId>", "Mail server ID").action(
+var healthCmd = new Command19("health").description("Show live status of every mail daemon").argument("<serverId>", "Mail server ID").action(
   guard2(async (serverId) => {
     const sp = spin2("Checking mail daemons\u2026");
     const res = await apiRequest(`/mail/health/${encodeURIComponent(serverId)}`);
@@ -5859,7 +6922,7 @@ var healthCmd = new Command18("health").description("Show live status of every m
     );
   })
 );
-var logsCmd3 = new Command18("logs").description("Tail a mail component's journal (snapshot)").argument("<serverId>", "Mail server ID").argument("<component>", "Component key (postfix|dovecot|amavis|clamav|iredapd|postgresql|\u2026)").option("-n, --lines <n>", "Number of lines (max 1000)", "200").action(
+var logsCmd3 = new Command19("logs").description("Tail a mail component's journal (snapshot)").argument("<serverId>", "Mail server ID").argument("<component>", "Component key (postfix|dovecot|amavis|clamav|iredapd|postgresql|\u2026)").option("-n, --lines <n>", "Number of lines (max 1000)", "200").action(
   guard2(async (serverId, component, opts) => {
     const res = await apiRequest(
       `/mail/admin/${encodeURIComponent(serverId)}/components/${encodeURIComponent(component)}/logs?lines=${encodeURIComponent(opts.lines)}`
@@ -5869,9 +6932,9 @@ var logsCmd3 = new Command18("logs").description("Tail a mail component's journa
     for (const line of res.lines) process.stdout.write(line + "\n");
   })
 );
-var postmasterCmd = new Command18("postmaster").description("Manage the postmaster mailbox");
+var postmasterCmd = new Command19("postmaster").description("Manage the postmaster mailbox");
 postmasterCmd.addCommand(
-  new Command18("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
+  new Command19("set-password").description("Rotate the postmaster password").argument("<serverId>", "Mail server ID").option("--password <password>", "New password (min 12 chars); prompted if omitted").action(
     guard2(async (serverId, opts) => {
       let password2 = opts.password;
       if (!password2) {
@@ -5897,12 +6960,12 @@ postmasterCmd.addCommand(
     })
   )
 );
-var mailCommand = new Command18("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
+var mailCommand = new Command19("mail").description("Self-hosted mail server (iRedMail) setup and admin [self-host]").addCommand(stepsCmd).addCommand(statusCmd).addCommand(serversCmd).addCommand(scanCmd).addCommand(adoptCmd).addCommand(setupCmd).addCommand(cancelCmd).addCommand(dnsAckCmd).addCommand(ptrAckCmd).addCommand(resetCmd).addCommand(forgetCmd).addCommand(healthCmd).addCommand(logsCmd3).addCommand(postmasterCmd);
 
 // src/commands/backup.ts
-import { Command as Command19 } from "commander";
+import { Command as Command20 } from "commander";
 import ora7 from "ora";
-import { readFileSync as readFileSync6 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 async function guard3(fn) {
   try {
     await fn();
@@ -5985,7 +7048,7 @@ async function followStream(path2, label) {
   spinner3?.stop();
   return status;
 }
-var policyCmd = new Command19("policy").description("Backup policies (schedules) for a project");
+var policyCmd = new Command20("policy").description("Backup policies (schedules) for a project");
 policyCmd.command("list").description("List backup policies for a project").requiredOption("--project <id>", "Project ID").action(
   (opts) => guard3(async () => {
     const { data } = await apiRequest(
@@ -6055,7 +7118,7 @@ policyCmd.command("run").description("Trigger a policy's backup now").argument("
     }
   })
 );
-var runCmd = new Command19("run").description("Backup runs (executions)");
+var runCmd = new Command20("run").description("Backup runs (executions)");
 runCmd.command("list").description("List backup runs for a project").requiredOption("--project <id>", "Project ID").option("--service <id>", "Filter to a single service").option("--limit <n>", "Max rows (default 50)").action(
   (opts) => guard3(async () => {
     const qs = new URLSearchParams();
@@ -6131,7 +7194,7 @@ runCmd.command("restore").description("Prepare a restore from a run (stages it;
     }
   })
 );
-var restoreCmd = new Command19("restore").description("Manage staged restores");
+var restoreCmd = new Command20("restore").description("Manage staged restores");
 restoreCmd.command("apply").description("Apply a staged restore (destructive)").argument("<restoreId>", "Restore ID from `backup run restore`").requiredOption("--token <token>", "Confirmation token from prepare").option("--follow", "Stream the restore to completion").action(
   (restoreId, opts) => guard3(async () => {
     await apiRequest(
@@ -6174,7 +7237,7 @@ restoreCmd.command("get").description("Show one restore (optionally stream it)")
     show(data);
   })
 );
-var destinationCmd = new Command19("destination").description("Backup destinations (storage targets)");
+var destinationCmd = new Command20("destination").description("Backup destinations (storage targets)");
 destinationCmd.command("list").description("List backup destinations").action(
   () => guard3(async () => {
     const { data } = await apiRequest("/backup-destinations");
@@ -6195,7 +7258,7 @@ destinationCmd.command("create").description("Create a backup destination").requ
     let sftpPrivateKey = opts.sftpPrivateKey;
     if (opts.sftpPrivateKeyFile) {
       try {
-        sftpPrivateKey = readFileSync6(opts.sftpPrivateKeyFile, "utf8");
+        sftpPrivateKey = readFileSync10(opts.sftpPrivateKeyFile, "utf8");
       } catch {
         throw new Error(`Cannot read key file: ${opts.sftpPrivateKeyFile}`);
       }
@@ -6246,10 +7309,10 @@ destinationCmd.command("preflight").description("Verify a destination (write + r
     }
   })
 );
-var backupCommand = new Command19("backup").description("Manage backups: policies, runs, restores, destinations").addCommand(policyCmd).addCommand(runCmd).addCommand(restoreCmd).addCommand(destinationCmd);
+var backupCommand = new Command20("backup").description("Manage backups: policies, runs, restores, destinations").addCommand(policyCmd).addCommand(runCmd).addCommand(restoreCmd).addCommand(destinationCmd);
 
 // src/commands/token.ts
-import { Command as Command20 } from "commander";
+import { Command as Command21 } from "commander";
 import chalk15 from "chalk";
 
 // src/lib/cmd-helpers.ts
@@ -6277,7 +7340,7 @@ function collectGrant(value, acc) {
   acc.push({ resourceType, resourceId, permissions });
   return acc;
 }
-var listCmd5 = new Command20("list").description("List your personal access tokens").action(async () => {
+var listCmd5 = new Command21("list").description("List your personal access tokens").action(async () => {
   try {
     const res = await apiRequest("/tokens");
     const rows = res.data ?? [];
@@ -6302,7 +7365,7 @@ var listCmd5 = new Command20("list").description("List your personal access toke
     fail3(e);
   }
 });
-var createCmd3 = new Command20("create").description("Mint a new personal access token (the secret is shown once)").argument("<name>", "Human-readable token name").option("--read-only", "Reject mutation methods (POST/PUT/PATCH/DELETE)", false).option("--expires <days>", "Expire after N days (1\u2013365); omit for non-expiring", (v) => parseInt(v, 10)).option(
+var createCmd3 = new Command21("create").description("Mint a new personal access token (the secret is shown once)").argument("<name>", "Human-readable token name").option("--read-only", "Reject mutation methods (POST/PUT/PATCH/DELETE)", false).option("--expires <days>", "Expire after N days (1\u2013365); omit for non-expiring", (v) => parseInt(v, 10)).option(
   "--grant <type:id:perms>",
   "Scope the token to a resource (repeatable), e.g. project:abc123:read,write",
   collectGrant,
@@ -6334,7 +7397,7 @@ var createCmd3 = new Command20("create").description("Mint a new personal access
     fail3(e);
   }
 });
-var revokeCmd = new Command20("revoke").description("Revoke one of your tokens").argument("<id>", "Token ID").action(async (id) => {
+var revokeCmd = new Command21("revoke").description("Revoke one of your tokens").argument("<id>", "Token ID").action(async (id) => {
   const sp = spin3("Revoking token\u2026");
   try {
     await apiRequest(`/tokens/${encodeURIComponent(id)}`, { method: "DELETE" });
@@ -6346,11 +7409,11 @@ var revokeCmd = new Command20("revoke").description("Revoke one of your tokens")
     fail3(e);
   }
 });
-var tokenCommand = new Command20("token").description("Manage personal access tokens").addCommand(listCmd5).addCommand(createCmd3).addCommand(revokeCmd);
+var tokenCommand = new Command21("token").description("Manage personal access tokens").addCommand(listCmd5).addCommand(createCmd3).addCommand(revokeCmd);
 
 // src/commands/api.ts
-import { Command as Command21 } from "commander";
-var apiCommand = new Command21("api").description("Make an authenticated request to any Openship API route (like `gh api`)").argument("<path>", "Path under /api, e.g. /projects or /deployments/<id>").option("-X, --method <method>", "HTTP method (defaults to GET, or POST when --data is given)").option("-d, --data <json>", "Request body as a JSON string").option("-q, --query <kv...>", "Query parameter key=value (repeatable)").action(async (path2, opts) => {
+import { Command as Command22 } from "commander";
+var apiCommand = new Command22("api").description("Make an authenticated request to any Openship API route (like `gh api`)").argument("<path>", "Path under /api, e.g. /projects or /deployments/<id>").option("-X, --method <method>", "HTTP method (defaults to GET, or POST when --data is given)").option("-d, --data <json>", "Request body as a JSON string").option("-q, --query <kv...>", "Query parameter key=value (repeatable)").action(async (path2, opts) => {
   const method = (opts.method || (opts.data ? "POST" : "GET")).toUpperCase();
   let url = path2.startsWith("/") ? path2 : `/${path2}`;
   if (opts.query?.length) {
@@ -6383,12 +7446,73 @@ var apiCommand = new Command21("api").description("Make an authenticated request
   }
 });
 
+// src/commands/reset-admin.ts
+import { Command as Command23 } from "commander";
+import chalk16 from "chalk";
+import { intro, outro, password as passwordPrompt, isCancel, cancel as cancel2, log } from "@clack/prompts";
+import { readFileSync as readFileSync11 } from "fs";
+import { homedir as homedir8 } from "os";
+import { join as join13 } from "path";
+function resolvedApiPort() {
+  try {
+    return JSON.parse(readFileSync11(join13(homedir8(), ".openship", "ports.json"), "utf8")).api;
+  } catch {
+    return void 0;
+  }
+}
+var resetAdminCommand = new Command23("reset-admin-password").description("Reset the local admin login on THIS machine (no sign-in required)").option("--port <port>", "API port of the running service (default: the resolved port from ~/.openship/ports.json, else 4000)").option("--email <email>", "Also set the admin email").option("--name <name>", "Also set the admin display name").option("--password <password>", "New password (prompted if omitted)").action(async (opts) => {
+  intro(chalk16.cyan("Reset Openship admin password"));
+  let pw = opts.password;
+  if (!pw) {
+    if (!process.stdin.isTTY) {
+      log.error("--password is required in non-interactive mode.");
+      process.exit(1);
+    }
+    const entered = await passwordPrompt({
+      message: "New admin password",
+      validate: (v) => v && v.length >= 8 && v.length <= 128 ? void 0 : "8\u2013128 characters"
+    });
+    if (isCancel(entered)) {
+      cancel2("Cancelled.");
+      process.exit(0);
+    }
+    const confirm3 = await passwordPrompt({
+      message: "Confirm password",
+      validate: (v) => v === entered ? void 0 : "Passwords don't match"
+    });
+    if (isCancel(confirm3)) {
+      cancel2("Cancelled.");
+      process.exit(0);
+    }
+    pw = entered;
+  }
+  const port = String(opts.port || resolvedApiPort() || 4e3);
+  let res;
+  try {
+    res = await fetch(`http://127.0.0.1:${port}/api/system/reset-admin-password`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-Internal-Token": ensureInternalToken() },
+      body: JSON.stringify({ password: pw, email: opts.email, name: opts.name })
+    });
+  } catch {
+    log.error(`Couldn't reach the Openship API on port ${port}. Is it running? (openship status)`);
+    log.info("If it's listening on another port, pass --port <n>.");
+    process.exit(1);
+  }
+  const data = await res.json().catch(() => ({}));
+  if (!res.ok || !data.ok) {
+    log.error(`Reset failed: ${data.error || res.statusText}`);
+    process.exit(1);
+  }
+  outro(chalk16.green(`Password reset. Log in as ${data.email} with your new password.`));
+});
+
 // src/commands/install.ts
-import { Command as Command22 } from "commander";
-import { chmodSync as chmodSync2, existsSync as existsSync9, mkdirSync as mkdirSync7, readFileSync as readFileSync7, writeFileSync as writeFileSync7 } from "fs";
-import { spawn as spawn2, spawnSync as spawnSync4 } from "child_process";
-import { homedir as homedir5 } from "os";
-import { join as join9 } from "path";
+import { Command as Command24 } from "commander";
+import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync9, readFileSync as readFileSync12, writeFileSync as writeFileSync9 } from "fs";
+import { spawn as spawn3, spawnSync as spawnSync5 } from "child_process";
+import { homedir as homedir9 } from "os";
+import { join as join14 } from "path";
 import ora9 from "ora";
 function assetForPlatform() {
   const { platform, arch } = process;
@@ -6400,33 +7524,33 @@ function assetForPlatform() {
   throw new Error(`Unsupported platform: ${platform} (${arch})`);
 }
 function installDmg(dmg) {
-  const homeApps = join9(homedir5(), "Applications");
+  const homeApps = join14(homedir9(), "Applications");
   let dest = homeApps;
   try {
-    mkdirSync7(homeApps, { recursive: true });
+    mkdirSync9(homeApps, { recursive: true });
   } catch {
     dest = "/Applications";
   }
-  const attach = spawnSync4("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
+  const attach = spawnSync5("hdiutil", ["attach", "-nobrowse", "-readonly", "-noverify", dmg], {
     encoding: "utf8"
   });
   if (attach.status !== 0) throw new Error(`hdiutil attach failed: ${attach.stderr?.trim()}`);
   const mount = (attach.stdout.match(/\/Volumes\/[^\n]*/g) ?? []).pop()?.trim();
   if (!mount) throw new Error("Could not determine the mounted volume");
-  let target = join9(dest, "Openship.app");
+  let target = join14(dest, "Openship.app");
   try {
-    const appInDmg = join9(mount, "Openship.app");
-    if (!existsSync9(appInDmg)) throw new Error("Openship.app not found in the disk image");
-    spawnSync4("rm", ["-rf", target]);
-    let copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
+    const appInDmg = join14(mount, "Openship.app");
+    if (!existsSync12(appInDmg)) throw new Error("Openship.app not found in the disk image");
+    spawnSync5("rm", ["-rf", target]);
+    let copy = spawnSync5("ditto", [appInDmg, target], { encoding: "utf8" });
     if (copy.status !== 0 && dest === homeApps) {
-      target = join9("/Applications", "Openship.app");
-      spawnSync4("rm", ["-rf", target]);
-      copy = spawnSync4("ditto", [appInDmg, target], { encoding: "utf8" });
+      target = join14("/Applications", "Openship.app");
+      spawnSync5("rm", ["-rf", target]);
+      copy = spawnSync5("ditto", [appInDmg, target], { encoding: "utf8" });
     }
     if (copy.status !== 0) throw new Error(`ditto copy failed: ${copy.stderr?.trim()}`);
   } finally {
-    spawnSync4("hdiutil", ["detach", mount, "-quiet"]);
+    spawnSync5("hdiutil", ["detach", mount, "-quiet"]);
   }
   return target;
 }
@@ -6435,10 +7559,10 @@ function installAppImage(appImage) {
   return appImage;
 }
 function installZip(zip) {
-  const localAppData = process.env.LOCALAPPDATA || join9(homedir5(), "AppData", "Local");
-  const target = join9(localAppData, "Programs", "Openship");
-  mkdirSync7(target, { recursive: true });
-  const expand = spawnSync4(
+  const localAppData = process.env.LOCALAPPDATA || join14(homedir9(), "AppData", "Local");
+  const target = join14(localAppData, "Programs", "Openship");
+  mkdirSync9(target, { recursive: true });
+  const expand = spawnSync5(
     "powershell",
     [
       "-NoProfile",
@@ -6453,22 +7577,22 @@ function installZip(zip) {
 }
 function launch(kind, target) {
   if (kind === "dmg") {
-    spawnSync4("open", [target]);
+    spawnSync5("open", [target]);
     return;
   }
   if (kind === "appimage") {
-    const child = spawn2(target, [], { detached: true, stdio: "ignore" });
+    const child = spawn3(target, [], { detached: true, stdio: "ignore" });
     child.on("error", () => {
-      spawn2(target, ["--appimage-extract-and-run"], { detached: true, stdio: "ignore" }).unref();
+      spawn3(target, ["--appimage-extract-and-run"], { detached: true, stdio: "ignore" }).unref();
     });
     child.unref();
     return;
   }
-  const exe = join9(target, "Openship.exe");
-  const path2 = existsSync9(exe) ? exe : target;
-  spawnSync4("cmd", ["/c", "start", "", path2]);
+  const exe = join14(target, "Openship.exe");
+  const path2 = existsSync12(exe) ? exe : target;
+  spawnSync5("cmd", ["/c", "start", "", path2]);
 }
-var installCommand = new Command22("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
+var installCommand = new Command24("install").description("Download and install the Openship desktop app for this OS").option("--version <tag>", "Release tag to install (e.g. v1.2.3)").option("--latest", "Install the latest release (default)").option("--force", "Re-download even if a verified copy is cached").option("--no-verify", "Skip SHA-256 verification (allowed when no sidecar exists)").option("--no-launch", "Install without launching the app").action(async (opts) => {
   let asset;
   try {
     asset = assetForPlatform();
@@ -6491,13 +7615,13 @@ var installCommand = new Command22("install").description("Download and install
     process.exit(1);
   }
   const dir = releaseDir(tag);
-  const assetPath = join9(dir, asset.name);
+  const assetPath = join14(dir, asset.name);
   const sidecarPath = `${assetPath}.sha256`;
   const assetUrl2 = `${RELEASES}/download/${tag}/${asset.name}`;
   const sidecarUrl = `${assetUrl2}.sha256`;
   let downloaded = false;
   let sha;
-  const cachedUsable = !opts.force && existsSync9(assetPath) && (existsSync9(sidecarPath) || opts.verify === false);
+  const cachedUsable = !opts.force && existsSync12(assetPath) && (existsSync12(sidecarPath) || opts.verify === false);
   if (cachedUsable) {
     info(`  Using cached ${asset.name} (${tag}).`);
   } else {
@@ -6519,8 +7643,8 @@ var installCommand = new Command22("install").description("Download and install
     const s2 = spin4("Verifying checksum\u2026");
     try {
       let sidecarBody;
-      if (existsSync9(sidecarPath) && !downloaded) {
-        sidecarBody = readFileSync7(sidecarPath, "utf8");
+      if (existsSync12(sidecarPath) && !downloaded) {
+        sidecarBody = readFileSync12(sidecarPath, "utf8");
       } else {
         sidecarBody = await fetchSidecar(sidecarUrl);
       }
@@ -6543,8 +7667,8 @@ var installCommand = new Command22("install").description("Download and install
         err(`Expected ${expected}, got ${actual}. The download may be corrupt or tampered with.`);
         process.exit(1);
       }
-      mkdirSync7(dir, { recursive: true });
-      writeFileSync7(sidecarPath, sidecarBody);
+      mkdirSync9(dir, { recursive: true });
+      writeFileSync9(sidecarPath, sidecarBody);
       s2?.succeed("Checksum verified");
     } catch (e) {
       s2?.fail("Verification failed");
@@ -6583,15 +7707,15 @@ var installCommand = new Command22("install").description("Download and install
 });
 
 // src/commands/update.ts
-import { Command as Command23 } from "commander";
-import { spawnSync as spawnSync5 } from "child_process";
+import { Command as Command25 } from "commander";
+import { spawnSync as spawnSync6 } from "child_process";
 function detectPackageManager2(override) {
   if (override === "bun" || override === "npm") return override;
-  const hasBun = spawnSync5("bun", ["--version"], { stdio: "ignore" }).status === 0;
+  const hasBun = spawnSync6("bun", ["--version"], { stdio: "ignore" }).status === 0;
   return hasBun ? "bun" : "npm";
 }
-var updateCommand = new Command23("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
-  const current = "0.2.1";
+var updateCommand = new Command25("update").description("Update the Openship CLI + bundled server to the latest release").option("--check", "Only report the current + latest version; don't install").option("--via <manager>", "Package manager to update with: bun | npm").action(async (opts) => {
+  const current = "0.2.3";
   let latest;
   try {
     latest = (await resolveLatestTag()).replace(/^v/, "");
@@ -6619,7 +7743,7 @@ var updateCommand = new Command23("update").description("Update the Openship CLI
   const ref = `openship@${latest}`;
   const argv = pm === "bun" ? ["add", "-g", ref] : ["install", "-g", ref];
   info(`Updating v${current} \u2192 v${latest} (${cliInstallCommand(pm, latest)})...`);
-  const res = spawnSync5(pm, argv, { stdio: "inherit" });
+  const res = spawnSync6(pm, argv, { stdio: "inherit" });
   if (res.status !== 0) {
     err(`Update failed (${pm} exited ${res.status ?? "with a signal"}). Reinstall manually: ${cliInstallCommand(pm, latest)}`);
     process.exitCode = 1;
@@ -6636,18 +7760,18 @@ var updateCommand = new Command23("update").description("Update the Openship CLI
 });
 
 // src/commands/cache.ts
-import { Command as Command24 } from "commander";
-import { existsSync as existsSync10, readdirSync, readFileSync as readFileSync8, rmSync as rmSync4, statSync } from "fs";
-import { join as join10 } from "path";
+import { Command as Command26 } from "commander";
+import { existsSync as existsSync13, readdirSync, readFileSync as readFileSync13, rmSync as rmSync4, statSync } from "fs";
+import { join as join15 } from "path";
 function listAssets() {
-  if (!existsSync10(RELEASES_DIR)) return [];
+  if (!existsSync13(RELEASES_DIR)) return [];
   const out = [];
   for (const tag of readdirSync(RELEASES_DIR)) {
     const dir = releaseDir(tag);
     if (!statSync(dir).isDirectory()) continue;
     for (const name of readdirSync(dir)) {
       if (name.endsWith(".sha256")) continue;
-      const path2 = join10(dir, name);
+      const path2 = join15(dir, name);
       const st = statSync(path2);
       if (!st.isFile()) continue;
       out.push({
@@ -6655,17 +7779,17 @@ function listAssets() {
         name,
         path: path2,
         size: st.size,
-        hasSidecar: existsSync10(`${path2}.sha256`)
+        hasSidecar: existsSync13(`${path2}.sha256`)
       });
     }
   }
   return out;
 }
-var pathCmd = new Command24("path").description("Print the cache directory path").action(() => {
+var pathCmd = new Command26("path").description("Print the cache directory path").action(() => {
   if (isJsonMode()) printJson({ path: CACHE_DIR });
   else process.stdout.write(CACHE_DIR + "\n");
 });
-var listCmd6 = new Command24("list").alias("ls").description("List cached release assets").action(() => {
+var listCmd6 = new Command26("list").alias("ls").description("List cached release assets").action(() => {
   const assets = listAssets();
   printTable(
     assets.map((a) => ({
@@ -6677,7 +7801,7 @@ var listCmd6 = new Command24("list").alias("ls").description("List cached releas
     ["tag", "asset", "size", "sidecar"]
   );
 });
-var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
+var verifyCmd2 = new Command26("verify").description("Re-hash cached assets and compare to their .sha256 sidecar").argument("[tag]", "Only verify assets under this release tag").action(async (tag) => {
   const assets = listAssets().filter((a) => !tag || a.tag === tag);
   const results = [];
   let bad = 0;
@@ -6686,7 +7810,7 @@ var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and
       results.push({ tag: a.tag, asset: a.name, result: "no-sidecar" });
       continue;
     }
-    const expected = parseSha256(readFileSync8(`${a.path}.sha256`, "utf8"));
+    const expected = parseSha256(readFileSync13(`${a.path}.sha256`, "utf8"));
     const actual = await hashFile(a.path);
     const okMatch = expected !== null && expected === actual;
     if (!okMatch) bad += 1;
@@ -6700,9 +7824,9 @@ var verifyCmd2 = new Command24("verify").description("Re-hash cached assets and
   }
   if (bad > 0) process.exit(1);
 });
-var cleanCmd = new Command24("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
+var cleanCmd = new Command26("clean").description("Delete cached release assets").argument("[tag]", "Only remove this release tag (default: all)").action((tag) => {
   const target = tag ? releaseDir(tag) : RELEASES_DIR;
-  if (!existsSync10(target)) {
+  if (!existsSync13(target)) {
     if (isJsonMode()) printJson({ removed: false, path: target });
     else info(`  Nothing to clean (${target}).`);
     return;
@@ -6713,32 +7837,33 @@ var cleanCmd = new Command24("clean").description("Delete cached release assets"
   Removed ${target}
 `);
 });
-var cacheCommand = new Command24("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
+var cacheCommand = new Command26("cache").description("Manage the local download cache (list/verify/clean/path)").action(() => {
   err("Specify a subcommand: path | list | verify | clean");
   process.exit(1);
 }).addCommand(pathCmd).addCommand(listCmd6).addCommand(verifyCmd2).addCommand(cleanCmd);
 
 // src/commands/wizard.ts
-import chalk16 from "chalk";
+import chalk17 from "chalk";
 import open from "open";
-import { createServer } from "http";
 import { createHash as createHash2, randomBytes as randomBytes2 } from "crypto";
+import { existsSync as existsSync14, readFileSync as readFileSync14 } from "fs";
+import { homedir as homedir10 } from "os";
+import { join as join16 } from "path";
 import {
-  intro,
-  outro,
+  intro as intro2,
+  outro as outro2,
   text,
   password,
   select,
-  confirm as confirm3,
   spinner as spinner2,
   note,
-  log,
-  cancel as cancel2,
-  isCancel
+  log as log2,
+  cancel as cancel3,
+  isCancel as isCancel2
 } from "@clack/prompts";
 function ensure(value) {
-  if (isCancel(value)) {
-    cancel2("Setup cancelled.");
+  if (isCancel2(value)) {
+    cancel3("Setup cancelled.");
     process.exit(0);
   }
   return value;
@@ -6776,6 +7901,19 @@ async function bootstrapAdmin(apiPort, admin) {
   if (data?.error === "An admin account already exists") return { ok: true, message: "already-exists" };
   return { ok: false, message: data?.error || "failed" };
 }
+function lastServiceError() {
+  for (const name of ["up.err.log", "up.log"]) {
+    const p = join16(homedir10(), ".openship", "logs", name);
+    if (!existsSync14(p)) continue;
+    try {
+      const lines = readFileSync14(p, "utf8").trim().split("\n");
+      const hit = [...lines].reverse().find((l) => /error|locked|EADDRINUSE|throw|cannot/i.test(l));
+      if (hit) return hit.trim().slice(0, 200);
+    } catch {
+    }
+  }
+  return null;
+}
 async function waitHealthy(apiPort, seconds = 90) {
   for (let i = 0; i < seconds; i++) {
     await new Promise((r) => setTimeout(r, 1e3));
@@ -6787,6 +7925,20 @@ async function waitHealthy(apiPort, seconds = 90) {
   }
   return false;
 }
+async function waitDashboard(dashPort, seconds = 45) {
+  for (let i = 0; i < seconds; i++) {
+    await new Promise((r) => setTimeout(r, 1e3));
+    try {
+      const res = await fetch(`http://127.0.0.1:${dashPort}/`, {
+        redirect: "manual",
+        signal: AbortSignal.timeout(2e3)
+      });
+      if (res.status > 0) return true;
+    } catch {
+    }
+  }
+  return false;
+}
 async function detectPublicIp() {
   for (const url of ["https://api.ipify.org", "https://ifconfig.me/ip"]) {
     try {
@@ -6803,65 +7955,58 @@ var b64url = (buf) => buf.toString("base64").replace(/\+/g, "-").replace(/\//g,
 async function connectOpenshipCloud(port) {
   const already = await internalGet(port, "/api/system/cloud-status");
   if (already?.connected) {
-    log.success(`Already connected to Openship Cloud${already.user?.email ? ` as ${already.user.email}` : ""}.`);
-    return true;
+    log2.success(`Already connected to Openship Cloud${already.user?.email ? ` as ${already.user.email}` : ""}.`);
+    return { email: already.user?.email ?? null };
   }
   const capsEnv = await internalGet(port, "/api/health/env");
   const cloudApiUrl = capsEnv?.cloudApiUrl;
   if (!cloudApiUrl) {
-    log.error("Couldn't discover the Openship Cloud URL \u2014 free domain unavailable. Use a custom domain instead.");
-    return false;
+    log2.error("Couldn't discover the Openship Cloud URL \u2014 free domain unavailable. Use a custom domain instead.");
+    return null;
   }
   const verifier = b64url(randomBytes2(32));
   const challenge = b64url(createHash2("sha256").update(verifier).digest());
-  const state = b64url(randomBytes2(16));
-  const codePromise = new Promise((resolve2) => {
-    const server2 = createServer((req, res2) => {
-      const u = new URL(req.url || "/", "http://127.0.0.1");
-      if (!u.pathname.startsWith("/callback")) {
-        res2.writeHead(404).end();
-        return;
-      }
-      const code2 = u.searchParams.get("code");
-      const gotState = u.searchParams.get("state");
-      res2.writeHead(200, { "Content-Type": "text/html" }).end(
-        "<html><body style='font:16px system-ui;padding:3rem;text-align:center'><h2>Openship Cloud connected</h2><p>You can close this window and return to your terminal.</p></body></html>"
-      );
-      server2.close();
-      resolve2(code2 && gotState === state ? code2 : null);
-    });
-    server2.on("error", () => resolve2(null));
-    server2.listen(0, "127.0.0.1", () => {
-      const cbPort = server2.address().port;
-      const redirect = `http://127.0.0.1:${cbPort}/callback`;
-      const handoff = `${cloudApiUrl.replace(/\/$/, "")}/api/cloud/connect-handoff?redirect=${encodeURIComponent(redirect)}&state=${state}&code_challenge=${challenge}`;
-      note(handoff, "Open this URL to authorize (opening your browser\u2026)");
-      void open(handoff).catch(() => {
-      });
-    });
-    setTimeout(() => {
-      try {
-        server2.close();
-      } catch {
-      }
-      resolve2(null);
-    }, 3e5);
+  const state = b64url(randomBytes2(24));
+  const apiBase = cloudApiUrl.replace(/\/$/, "");
+  const handoff = `${apiBase}/api/cloud/connect-handoff?redirect=${encodeURIComponent(apiBase)}&state=${encodeURIComponent(state)}&code_challenge=${challenge}&mode=device`;
+  const overSsh = !!(process.env.SSH_CONNECTION || process.env.SSH_TTY || process.env.SSH_CLIENT);
+  note(handoff, "Open this URL in your browser to authorize (then click Authorize)");
+  if (!overSsh) void open(handoff).catch(() => {
   });
   const s = spinner2();
-  s.start("Waiting for Openship Cloud authorization in your browser");
-  const code = await codePromise;
+  s.start("Waiting for you to authorize in the browser");
+  let code = null;
+  const deadline = Date.now() + 3e5;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, 2500));
+    try {
+      const res2 = await fetch(
+        `${apiBase}/api/cloud/connect-poll?state=${encodeURIComponent(state)}`,
+        { signal: AbortSignal.timeout(5e3) }
+      );
+      if (!res2.ok) continue;
+      const data = await res2.json();
+      if (data.status === "ready" && data.code) {
+        code = data.code;
+        break;
+      }
+    } catch {
+    }
+  }
   if (!code) {
-    s.stop("Openship Cloud wasn't authorized.", 1);
-    return false;
+    s.stop("Openship Cloud wasn't authorized in time \u2014 re-run the connect step to try again.", 1);
+    return null;
   }
-  s.message("Linking this instance to Openship Cloud");
+  s.stop("Authorized.");
+  const linking = spinner2();
+  linking.start("Linking this instance to Openship Cloud");
   const res = await internalPost(port, "/api/system/cloud-connect", { code, codeVerifier: verifier });
   if (!res.ok) {
-    s.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
-    return false;
+    linking.stop(`Couldn't link Openship Cloud: ${res.data?.error || "failed"}`, 1);
+    return null;
   }
-  s.stop("Connected to Openship Cloud.");
-  return true;
+  linking.stop(`Connected to Openship Cloud${res.data?.email ? ` as ${res.data.email}` : ""}.`);
+  return { email: res.data?.email ?? null };
 }
 async function promptLocalAdmin() {
   const name = ensure(await text({ message: "Your name", validate: (v) => v?.trim() ? void 0 : "Required" })).trim();
@@ -6922,161 +8067,315 @@ async function streamProvision(port, sessionId, s) {
   return ok3;
 }
 async function runWizard() {
-  intro(`${chalk16.bgCyan(chalk16.black(" Openship "))}${chalk16.dim(" setup")}`);
-  log.message(
-    chalk16.dim(
+  intro2(`${chalk17.bgCyan(chalk17.black(" Openship "))}${chalk17.dim(" setup")}`);
+  log2.message(
+    chalk17.dim(
       "Deploy Openship on this machine \u2014 a few questions, then it installs itself\nas a service, registers as an app, and prints the URL to log in."
     )
   );
+  log2.message(chalk17.dim("First, your instance login (email + password) \u2014 this is how you sign in. Domain and Openship Cloud come next and never replace it."));
+  const admin = await promptLocalAdmin();
+  let cloudEmail = null;
   let publicUrl;
   let behindProxy = false;
   let managedEdge = false;
   let domainPlan = { type: "none" };
-  const reach = ensure(
-    await select({
-      message: "How should this instance be reachable?",
-      initialValue: "private",
-      options: [
-        { value: "private", label: "Private", hint: "this machine only (localhost)" },
-        { value: "public", label: "Public", hint: "a server / VPS, reachable from other machines" }
-      ]
-    })
-  );
-  if (reach === "public") {
-    const canManage = process.platform === "linux";
-    const domainType = ensure(
-      await select({
-        message: "How do you want a domain + HTTPS?",
-        initialValue: "free",
-        options: [
-          { value: "free", label: "Free domain", hint: "name.opsh.io via Openship Cloud \u2014 HTTPS handled for you" },
-          ...canManage ? [{ value: "custom", label: "Custom domain", hint: "your domain + free Let's Encrypt on this box" }] : [],
-          { value: "byo", label: "Bring your own", hint: "your domain, behind your own reverse proxy" }
-        ]
+  const canManage = process.platform === "linux";
+  const BACK = "__back__";
+  let slug = "";
+  let customDomainInput = "";
+  let byoDomainInput = "";
+  let publicHost = null;
+  async function resolvePublicHost() {
+    if (publicHost) return publicHost;
+    const sp = spinner2();
+    sp.start("Detecting this server's public IP");
+    const detected = await detectPublicIp();
+    if (detected) {
+      sp.stop(`Public IP: ${chalk17.bold(detected)}`);
+      publicHost = detected;
+      return detected;
+    }
+    sp.stop("Couldn't detect the public IP automatically.", 1);
+    publicHost = ensure(
+      await text({
+        message: "This server's public IP or hostname",
+        placeholder: "203.0.113.10",
+        validate: (v) => v?.trim() ? void 0 : "Required \u2014 the edge proxy routes traffic to this address"
       })
-    );
-    if (domainType === "free") {
-      const slug = ensure(
+    ).trim();
+    return publicHost;
+  }
+  let stage = "reach";
+  log2.message(chalk17.dim("These are just starting choices \u2014 domain, Cloud, team, and the rest are all editable later in Settings."));
+  planning: while (true) {
+    if (stage === "reach") {
+      const reach = ensure(
+        await select({
+          message: "How should this instance be reachable?",
+          // Default to public — most people setting up on a server/VPS want a
+          // domain + HTTPS; localhost-only is the deliberate opt-out.
+          initialValue: "public",
+          options: [
+            { value: "public", label: "Public (server / VPS)", hint: "a domain + HTTPS, reachable from anywhere" },
+            { value: "private", label: "This machine only", hint: "localhost \u2014 no domain, log in on this box" }
+          ]
+        })
+      );
+      if (reach === "private") {
+        domainPlan = { type: "none" };
+        publicUrl = void 0;
+        behindProxy = false;
+        managedEdge = false;
+        break planning;
+      }
+      stage = "type";
+      continue;
+    }
+    if (stage === "type") {
+      const domainType = ensure(
+        await select({
+          message: "How do you want a domain + HTTPS?",
+          initialValue: "free",
+          options: [
+            { value: "free", label: "Free domain", hint: "name.opsh.io via Openship Cloud \u2014 HTTPS handled for you" },
+            ...canManage ? [{ value: "custom", label: "Custom domain", hint: "your domain + free Let's Encrypt on this box" }] : [],
+            { value: "byo", label: "Bring your own", hint: "your domain, behind your own reverse proxy" },
+            { value: BACK, label: "\u2190 Back" }
+          ]
+        })
+      );
+      if (domainType === BACK) {
+        stage = "reach";
+        continue;
+      }
+      stage = domainType;
+      continue;
+    }
+    if (stage === "free") {
+      slug = ensure(
         await text({
           message: "Choose your subdomain",
           placeholder: "my-openship",
+          initialValue: slug || void 0,
           validate: (v) => v && SLUG_RE.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
         })
       ).trim().toLowerCase();
-      const s2 = spinner2();
-      s2.start("Detecting this server's public IP");
-      const publicHost = await detectPublicIp();
-      s2.stop(publicHost ? `Public IP: ${chalk16.bold(publicHost)}` : "Couldn't detect the public IP automatically.");
+      const host = await resolvePublicHost();
+      note(
+        `${chalk17.cyan(`https://${slug}.opsh.io`)}
+
+  ${chalk17.dim("served via")}  Openship Cloud edge  ${chalk17.dim("\u2192")}  ${chalk17.cyan(host)}
+
+` + chalk17.dim("Openship Cloud terminates HTTPS and forwards to this server."),
+        "Confirm free domain"
+      );
+      const go2 = ensure(
+        await select({
+          message: "Create this free domain?",
+          options: [
+            { value: "go", label: "Create it" },
+            { value: BACK, label: "\u2190 Back", hint: "change subdomain or IP" }
+          ]
+        })
+      );
+      if (go2 === BACK) {
+        stage = "type";
+        continue;
+      }
       publicUrl = `https://${slug}.opsh.io`;
       behindProxy = true;
-      domainPlan = { type: "free", slug, publicHost };
-    } else if (domainType === "custom") {
-      const raw = ensure(
+      domainPlan = { type: "free", slug, publicHost: host };
+      break planning;
+    }
+    if (stage === "custom") {
+      const raw2 = ensure(
         await text({
           message: "Your domain",
           placeholder: "ops.example.com",
+          initialValue: customDomainInput || void 0,
           validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
         })
       );
-      publicUrl = normalizeUrl(raw).replace(/^http:/i, "https:");
-      const hostname = new URL(publicUrl).hostname;
-      managedEdge = true;
-      behindProxy = true;
+      customDomainInput = raw2;
+      const url2 = normalizeUrl(raw2).replace(/^http:/i, "https:");
+      const hostname2 = new URL(url2).hostname;
       if (typeof process.getuid === "function" && process.getuid() !== 0) {
-        log.warn("Managed HTTPS installs OpenResty + certbot \u2014 that needs root. Re-run with sudo if it can't install.");
+        log2.warn("Managed HTTPS installs OpenResty + certbot \u2014 that needs root. Re-run with sudo if it can't install.");
       }
-      const s2 = spinner2();
-      s2.start("Detecting this server's public IP");
-      const ip = await detectPublicIp();
-      s2.stop(ip ? `Public IP: ${chalk16.bold(ip)}` : "Couldn't detect the public IP automatically.");
+      const host = await resolvePublicHost();
       note(
-        `Add a DNS ${chalk16.bold("A record")}:
+        `Add a DNS ${chalk17.bold("A record")}:
 
-  ${chalk16.cyan(hostname)}  \u2192  ${chalk16.cyan(ip ?? "<this server's public IP>")}
+  ${chalk17.cyan(hostname2)}  \u2192  ${chalk17.cyan(host)}
 
-` + chalk16.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
+` + chalk17.dim("HTTPS is issued automatically once DNS resolves (it retries for a couple minutes)."),
         "DNS"
       );
-      ensure(await confirm3({ message: "A record set? (continue either way \u2014 it retries)", initialValue: true }));
-      domainPlan = { type: "custom", hostname };
-    } else {
-      const raw = ensure(
-        await text({
-          message: "Your domain (served behind your proxy)",
-          placeholder: "ops.example.com",
-          validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+      const go2 = ensure(
+        await select({
+          message: "A record added?",
+          options: [
+            { value: "go", label: "Continue", hint: "HTTPS provisions once DNS resolves \u2014 it retries" },
+            { value: BACK, label: "\u2190 Back", hint: "change the domain" }
+          ]
         })
       );
-      publicUrl = normalizeUrl(raw);
-      behindProxy = true;
-      if (publicUrl.startsWith("http://")) {
-        log.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
+      if (go2 === BACK) {
+        stage = "type";
+        continue;
       }
-      domainPlan = { type: "byo", hostname: new URL(publicUrl).hostname };
+      publicUrl = url2;
+      managedEdge = true;
+      behindProxy = true;
+      domainPlan = { type: "custom", hostname: hostname2 };
+      break planning;
+    }
+    const raw = ensure(
+      await text({
+        message: "Your domain (served behind your proxy)",
+        placeholder: "ops.example.com",
+        initialValue: byoDomainInput || void 0,
+        validate: (v) => v && normalizeUrl(v) ? void 0 : "Enter a valid domain"
+      })
+    );
+    byoDomainInput = raw;
+    const url = normalizeUrl(raw);
+    const hostname = new URL(url).hostname;
+    if (url.startsWith("http://")) {
+      log2.warn("Serving over plain HTTP sends passwords in cleartext \u2014 put HTTPS in front before real use.");
+    }
+    note(
+      `${chalk17.cyan(url)}
+
+` + chalk17.dim("Point your reverse proxy at the dashboard port shown at the end."),
+      "Confirm"
+    );
+    const go = ensure(
+      await select({
+        message: "Continue?",
+        options: [
+          { value: "go", label: "Continue" },
+          { value: BACK, label: "\u2190 Back", hint: "change the domain" }
+        ]
+      })
+    );
+    if (go === BACK) {
+      stage = "type";
+      continue;
     }
+    publicUrl = url;
+    behindProxy = true;
+    domainPlan = { type: "byo", hostname };
+    break planning;
+  }
+  const uiTag = `v${"0.2.3"}`;
+  const dl = spinner2();
+  dl.start("Pulling the Openship dist from GitHub");
+  try {
+    await ensureDashboard({
+      tag: uiTag,
+      onProgress: (received, total) => {
+        if (total) dl.message(`Pulling the Openship dist from GitHub \u2014 ${Math.round(received / total * 100)}%`);
+      }
+    });
+    dl.stop("Openship dist ready.");
+  } catch (e) {
+    dl.stop(`Couldn't pull the Openship dist: ${e.message}`, 1);
+    log2.info("Check your network / that this release published its dashboard asset, then re-run `openship`.");
+    process.exit(1);
   }
-  const isCloudDomain = domainPlan.type === "free";
-  const admin = isCloudDomain ? null : await promptLocalAdmin();
   const s = spinner2();
   s.start("Installing Openship as a service");
   let started;
   try {
-    started = startService(
-      { publicUrl, trustProxy: behindProxy, managedEdge, acmeEmail: managedEdge ? admin?.email : void 0 },
+    started = await startService(
+      { publicUrl, trustProxy: behindProxy, managedEdge, acmeEmail: managedEdge ? admin.email : void 0, uiVersion: uiTag },
       { quiet: true }
     );
   } catch (e) {
     s.stop("Couldn't install the service.", 1);
-    log.error(e.message);
-    log.info("Run `openship up --foreground` to run it attached and see the error.");
+    log2.error(e.message);
+    log2.info("Run `openship up --foreground` to run it attached and see the error.");
     process.exit(1);
   }
-  s.message("Waiting for Openship to come up");
+  s.message("Waiting for the Openship API");
   if (!await waitHealthy(started.port)) {
     s.stop("Openship didn't become healthy in time.", 1);
-    log.info("Check logs: `openship logs` (or `openship up --foreground`).");
+    const reason = lastServiceError();
+    if (reason) log2.error(reason);
+    if (reason && /lock/i.test(reason)) {
+      log2.info("The database is locked by another instance \u2014 run `openship stop`, then re-run `openship`.");
+    } else {
+      log2.info("Check logs: `openship logs` (or `openship up --foreground`).");
+    }
+    process.exit(1);
+  }
+  s.message("Creating your admin account");
+  const adminRes = await bootstrapAdmin(started.port, admin);
+  if (!adminRes.ok) {
+    s.stop(`Couldn't create the admin account: ${adminRes.message}`, 1);
     process.exit(1);
   }
-  if (admin) {
-    s.message("Creating your admin account");
-    const adminRes = await bootstrapAdmin(started.port, admin);
-    if (!adminRes.ok) {
-      s.stop(`Couldn't create the admin account: ${adminRes.message}`, 1);
+  if (adminRes.message === "already-exists") {
+    s.message("Applying your admin login");
+    const rr = await internalPost(started.port, "/api/system/reset-admin-password", {
+      email: admin.email,
+      name: admin.name,
+      password: admin.password
+    });
+    if (!rr.ok) {
+      s.stop(`Couldn't set your admin login: ${rr.data?.error || "failed"}`, 1);
       process.exit(1);
     }
-    s.stop(
-      adminRes.message === "already-exists" ? "An admin already exists \u2014 use your existing login." : `Admin account created for ${admin.email}.`
-    );
-  } else {
-    s.stop("Openship is up.");
   }
+  s.message(`Admin ready for ${admin.email}`);
+  s.message("Starting the Openship dashboard");
+  await waitDashboard(started.dashPort);
+  s.stop("Deployed.");
   let liveUrl = publicUrl ?? `http://localhost:${started.dashPort}`;
   const port = started.port;
   if (domainPlan.type === "free") {
-    const linked = await connectOpenshipCloud(port);
-    if (!linked) {
-      log.warn("Openship Cloud wasn't connected \u2014 set up a local admin instead. You can add the free domain later in Settings \u2192 Cloud.");
-      const fb = await promptLocalAdmin();
-      const abr = await bootstrapAdmin(port, fb);
-      if (!abr.ok) {
-        log.error(`Couldn't create the admin account: ${abr.message}`);
-        process.exit(1);
-      }
+    const cloud = await connectOpenshipCloud(port);
+    if (!cloud) {
+      log2.warn("Openship Cloud wasn't connected \u2014 skipping the free domain. Your local admin login still works; add the domain later in Settings \u2192 Cloud.");
       await internalPost(port, "/api/system/self-register", { domainType: "byo" });
     } else {
-      const s2 = spinner2();
-      s2.start("Registering your free domain with Openship Cloud");
-      const res = await internalPost(port, "/api/system/self-register", {
-        domainType: "free",
-        slug: domainPlan.slug,
-        publicHost: domainPlan.publicHost,
-        dashPort: Number(started.dashPort)
-      });
-      if (res.ok && res.data?.url) {
-        liveUrl = res.data.url;
-        s2.stop(`Free domain live: ${res.data.url}`);
-      } else {
-        s2.stop(`Couldn't register the free domain: ${res.data?.error || "failed"}`, 1);
+      cloudEmail = cloud.email;
+      let regSlug = domainPlan.slug;
+      while (true) {
+        const s2 = spinner2();
+        s2.start(`Registering ${chalk17.bold(`${regSlug}.opsh.io`)} with Openship Cloud`);
+        const res = await internalPost(port, "/api/system/self-register", {
+          domainType: "free",
+          slug: regSlug,
+          publicHost: domainPlan.publicHost,
+          dashPort: Number(started.dashPort)
+        });
+        if (res.ok && res.data?.url) {
+          liveUrl = res.data.url;
+          s2.stop(`Free domain live: ${res.data.url}`);
+          break;
+        }
+        s2.stop(`Couldn't register ${regSlug}.opsh.io: ${res.data?.error || "failed"}`, 1);
+        const next = ensure(
+          await select({
+            message: "Try a different subdomain?",
+            options: [
+              { value: "retry", label: "Pick another subdomain" },
+              { value: "skip", label: "Skip for now", hint: "log in on this server; add a domain later in Settings \u2192 Cloud" }
+            ]
+          })
+        );
+        if (next === "skip") break;
+        regSlug = ensure(
+          await text({
+            message: "Choose your subdomain",
+            placeholder: "my-openship",
+            initialValue: regSlug,
+            validate: (v) => v && SLUG_RE.test(v.trim().toLowerCase()) ? void 0 : "Lowercase letters, digits, hyphens"
+          })
+        ).trim().toLowerCase();
       }
     }
   } else if (domainPlan.type === "custom") {
@@ -7115,7 +8414,7 @@ async function runWizard() {
       else edgeTakeover = true;
     }
     if (!proceedCustom) {
-      log.warn(
+      log2.warn(
         "Left the existing proxy on 80/443 running. Registering Openship without managed HTTPS \u2014 front it with your proxy, or re-run setup to take over."
       );
       await internalPost(port, "/api/system/self-register", {
@@ -7140,7 +8439,7 @@ async function runWizard() {
         if (done) s2.stop(`HTTPS ready: ${liveUrl}`);
         else s2.stop("HTTPS isn't ready yet \u2014 it retries on reboot; the site serves over HTTP meanwhile.", 1);
       } else {
-        log.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
+        log2.warn(`Couldn't start domain provisioning: ${res.data?.error || "failed"}`);
       }
     }
   } else if (domainPlan.type === "byo") {
@@ -7152,23 +8451,105 @@ async function runWizard() {
   } else {
     await internalPost(port, "/api/system/self-register", { domainType: "byo" });
   }
+  saveInstanceUrl(liveUrl);
+  const pad = (label) => chalk17.dim(label.padEnd(11));
+  log2.success(chalk17.bold("Openship is live"));
+  log2.message(
+    `${pad("URL")}${chalk17.bold(liveUrl)}
+${pad("Dashboard")}http://localhost:${started.dashPort}
+${pad("API")}http://localhost:${started.port}
+${pad("Login")}${admin.email} ${chalk17.dim("(email + password you set)")}
+` + (cloudEmail ? `${pad("Cloud")}${chalk17.dim("connected as ")}${cloudEmail}${chalk17.dim(" \u2014 free domain + mail only")}
+` : "") + `${pad("Status")}${chalk17.green("running")} ${chalk17.dim("\xB7 service (restarts on boot)")}`
+  );
+  log2.message(
+    chalk17.dim("Sign in with the email + password you just set. Openship appears under your Apps.\n") + chalk17.dim("Change the domain, Openship Cloud, team, and everything else anytime in Settings.\n") + chalk17.dim(`Locked out? Run ${chalk17.reset("openship reset-admin-password")}${chalk17.dim(" on this machine \u2014 resets your login without signing in.")}`)
+  );
+  outro2(
+    domainPlan.type === "byo" ? chalk17.dim("Point your reverse proxy at the dashboard port above.") : chalk17.green("Happy shipping.")
+  );
+}
+function storedPorts() {
+  const p = join16(homedir10(), ".openship", "ports.json");
+  try {
+    return existsSync14(p) ? JSON.parse(readFileSync14(p, "utf8")) : {};
+  } catch {
+    return {};
+  }
+}
+async function runControl() {
+  const svc = serviceStatus();
+  const ports = storedPorts();
+  const apiPort = String(ports.api ?? 4e3);
+  const dashUrl = `http://localhost:${ports.dashboard ?? 3001}`;
+  const publicUrl = readInstanceUrl();
+  const primaryUrl = publicUrl && !/^https?:\/\/localhost/i.test(publicUrl) ? publicUrl : dashUrl;
+  intro2(`${chalk17.bgCyan(chalk17.black(" Openship "))}${chalk17.dim(" control")}`);
   note(
-    `${chalk16.bold(liveUrl)}
-
-` + chalk16.dim(`${admin ? `Log in as ${admin.email}` : "Log in with Openship Cloud"}. Openship now appears under your Apps, and runs as a service (restarts on boot).`),
-    "Openship is live"
+    `${chalk17.dim("URL".padEnd(11))}${chalk17.bold(primaryUrl)}
+${chalk17.dim("Service".padEnd(11))}${svc.running ? chalk17.green("running") : chalk17.yellow("stopped")}
+${chalk17.dim("Dashboard".padEnd(11))}${dashUrl}
+` + (ports.api ? `${chalk17.dim("API".padEnd(11))}http://localhost:${ports.api}
+` : "") + `${chalk17.dim("Manager".padEnd(11))}${svc.kind === "unsupported" ? "none" : svc.kind}`,
+    "Openship is already set up"
   );
-  outro(
-    domainPlan.type === "byo" ? chalk16.dim("Point your reverse proxy at the dashboard port above.") : chalk16.green("Happy shipping.")
+  const action2 = ensure(
+    await select({
+      message: "What would you like to do?",
+      options: [
+        { value: "open", label: "Open the dashboard" },
+        svc.running ? { value: "restart", label: "Restart the service" } : { value: "start", label: "Start the service" },
+        { value: "stop", label: "Stop the service", hint: "won't restart on boot" },
+        { value: "reset", label: "Reset admin password", hint: "sets a local email + password login" },
+        { value: "reconfigure", label: "Re-run setup", hint: "reconfigure domain / cloud / admin" },
+        { value: "quit", label: "Quit" }
+      ]
+    })
   );
+  switch (action2) {
+    case "open":
+      await open(primaryUrl).catch(() => {
+      });
+      outro2(chalk17.dim(`Opening ${primaryUrl}`));
+      return;
+    case "start":
+      await startService({});
+      return;
+    case "restart": {
+      const r = restart();
+      outro2(r.restarted ? chalk17.green("Restarted.") : chalk17.yellow(r.detail));
+      return;
+    }
+    case "stop": {
+      const r = stop();
+      outro2(chalk17.green(`Stopped. ${chalk17.dim(r.detail)}`));
+      return;
+    }
+    case "reset": {
+      const pw = ensure(
+        await password({ message: "New admin password", validate: (v) => v && v.length >= 8 ? void 0 : "At least 8 characters" })
+      );
+      const rr = await internalPost(apiPort, "/api/system/reset-admin-password", { password: pw });
+      outro2(
+        rr.ok ? chalk17.green(`Password reset. Sign in at ${dashUrl} with your email + new password.`) : chalk17.red(`Couldn't reset: ${rr.data?.error || "failed"}`)
+      );
+      return;
+    }
+    case "reconfigure":
+      await runWizard();
+      return;
+    default:
+      outro2(chalk17.dim("Nothing changed."));
+  }
 }
 
 // src/index.ts
-var program = new Command25();
-program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.1").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
+var program = new Command27();
+program.name("openship").description("Openship CLI \u2014 install, run, and manage Openship from your terminal").version("0.2.3").option("--json", "Machine-readable JSON output (stdout data only)").hook("preAction", (thisCommand) => {
   if (thisCommand.opts().json) setJsonMode(true);
 }).action(async () => {
-  await runWizard();
+  if (serviceStatus().installed) await runControl();
+  else await runWizard();
 });
 program.addCommand(upCommand);
 program.addCommand(stopCommand);
@@ -7178,6 +8559,7 @@ program.addCommand(openCommand);
 program.addCommand(loginCommand);
 program.addCommand(logoutCommand);
 program.addCommand(initCommand);
+program.addCommand(configCommand);
 program.addCommand(contextCommand);
 program.addCommand(statusCommand);
 program.addCommand(doctorCommand);
@@ -7193,5 +8575,6 @@ program.addCommand(mailCommand);
 program.addCommand(backupCommand);
 program.addCommand(tokenCommand);
 program.addCommand(apiCommand);
+program.addCommand(resetAdminCommand);
 installCommand.addCommand(cacheCommand);
 program.parse();